[Pdns-users] Journal Log Format for Recursor

[bert hubert]

Hello Chris,

On Sat, Dec 28, 2019 at 10:57:36PM +1100, Chris Jones wrote:
> Can someone please advise what the format of the following logs are that
> are going to journald.

Yes, but please know this format is not in any way guaranteed. In other
words, it might change from release to release. If you want to do any kind
of statistics, I urge you to look into our protobuf export which has many of
these same metrics.

> Request:
> "MESSAGE" : "3 [129/1] question for '
> brave-sync.s3.dualstack.us-west-2.amazonaws.com|A' from (client IP):9051"

3 means it was handled by operating system thread 3 within the recursor. The
numbers in square brackets have changed a bit I think, I remember the first
number being our internal query id, which increases all the time. 

> Response:
> "MESSAGE" : "3 [129/1] answer to question '
> brave-sync.s3.dualstack.us-west-2.amazonaws.com|A': 2 answers, 0
> additional, took 2 packets, 14.091 netw ms, 14.503 tot ms, 0 throttled, 0
> timeouts, 0 tcp connections, rcode=0"

> - what netw ms means

Wall clock time spent waiting on network responses.

> - what tot ms means

Wall clock time totally spent on this query. totms - netwms is a measure of
how much CPU time was spent internally.

	Bert