unkin/puppet-prod
4
0
Fork 0
Code Issues 15 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Enable named query logging on VM BIND (companion to the logging pipeline) #501

New Issue
Open
opened 2026-08-02 16:23:11 +10:00 by unkinben · 0 comments
unkinben commented 2026-08-02 16:23:11 +10:00
Owner
Copy Link
Copy Source

Problem
The Vector bind_query transform is deployed but VM BIND (profiles/dns/server.pp) does not emit query logs, so DNS query analytics/exfil-detection has no data on the VM resolvers.

Proposal

  • add a query-logging channel to the puppet-managed named config (rate-limited, to a file or stderr the VM Vector tails)

Acceptance

  • named emits client_ip/qname/qtype/rcode lines; they parse via the bind_query transform once the VM Vector rollout ships.
**Problem** The Vector `bind_query` transform is deployed but VM BIND (`profiles/dns/server.pp`) does not emit query logs, so DNS query analytics/exfil-detection has no data on the VM resolvers. **Proposal** - add a query-logging channel to the puppet-managed named config (rate-limited, to a file or stderr the VM Vector tails) **Acceptance** - named emits client_ip/qname/qtype/rcode lines; they parse via the bind_query transform once the VM Vector rollout ships.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/puppet-prod#501
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?