<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 13/01/2021 14:58, Michael Chisina
via Pdns-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAGD1Pmcy+pUZLf0kFLAkXGoy4+-uvuRMNkLZo46A073UwH1H2w@mail.gmail.com">
<div dir="auto">I want to frame stream powerdns recursor DNS
query and response using dnstap to an apache kafka remote server
(202.20.20.1). </div>
<div dir="auto"># what are the configurations needed on recursor?</div>
</blockquote>
<p>dnstap doesn't talk to kafka.</p>
<p>You'll need to run some middleware software which accepts <a
moz-do-not-send="true" href="https://dnstap.info/">dnstap</a>-formatted
messages, and writes them to kafka - which could be in raw dnstap
form, or decoded into some other form (e.g. JSON). Google "dnstap
kafka" for some options, or write your own.<br>
</p>
<p>Then you configure pdns-recursor to send dnstap messages to this
middleware server.</p>
<p>If you run the middleware on the same server as pdns-recursor,
then they can communicate over a unix domain socket. If you want
to communicate to a remote server over TCP, then you will need a
sufficiently new version of libfstrm which supports this. In
practice this means that if you are using Ubuntu then you need
20.04 not 18.04. See this thread:</p>
<p><a class="moz-txt-link-freetext" href="https://mailman.powerdns.com/pipermail/pdns-users/2020-June/026724.html">https://mailman.powerdns.com/pipermail/pdns-users/2020-June/026724.html</a><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:CAGD1Pmcy+pUZLf0kFLAkXGoy4+-uvuRMNkLZo46A073UwH1H2w@mail.gmail.com">
<div dir="auto"># what is dns message schema(s) format for the
database creation?</div>
</blockquote>
<p>kafka isn't a database. If you want to write these messages to a
database, then that's an additional step. You'll need some more
software which reads messages from kafka, decodes them, and writes
to a database in some schema that you define. Beware that a busy
recursor can generate a very large volume of messages, so you
might want to aggregate them first.<br>
</p>
<p>HTH,</p>
<p>Brian.<br>
</p>
</body>
</html>