<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">FYI, I’ve been working with one of the coders working on Telefrag and the following code is working beautifully so far: <a href="https://github.com/influxdata/telegraf/pull/11999" class="">https://github.com/influxdata/telegraf/pull/11999</a> <div class=""><br class=""></div><div class="">-- Djerk</div><div class=""><div><br class=""></div><div><blockquote type="cite" class=""><div class="">On 1 Oct 2022, at 10:31, Djerk Geurts <<a href="mailto:djerk@maizymoo.com" class="">djerk@maizymoo.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 1 Oct 2022, at 07:28, Otto Moerbeek <<a href="mailto:otto@drijf.net" class="">otto@drijf.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">The protobuf streams add a framing header of two bytes of length per protobuf message.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">The receiving side has to take that into account.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote><div class=""><br class=""></div><div class="">I have no idea if it does as the Telegraf xpack_protobuf input doesn’t have that many options to configure things. Processing after the input has been accepted, sure. But I’m not aware of a way to strip header bytes at the input.</div><br class=""><blockquote type="cite" class=""><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">The dnstap streams use the framestream format. In the recursor, they</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">are only implented to report on outgoing queries and their replies though,.</span></div></blockquote></div><br class=""><div class="">Pdns-recursor here and only interested in logQueries, which is configurable like so:</div><div class=""><br class=""></div><div class=""><div class="">-- RPZ query logging</div><div class="">protobufServer("127.0.0.1:8000", {</div><div class=""> taggedOnly=true,</div><div class=""> logQueries=true,</div><div class=""> logResponses=false,</div><div class=""> exportTypes={'A', 'AAAA', 'CNAME', 'MX', 'NS', 'PTR', 'SPF', 'SRV', 'TXT'}</div><div class="">})</div></div><div class=""><br class=""></div><div class="">-- Djerk</div></div></div></blockquote></div><br class=""></div></body></html>