[Pdns-users] Protobuf - Telegraf

[Otto Moerbeek]

On Sat, Oct 01, 2022 at 12:56:45AM +0100, Djerk Geurts via Pdns-users wrote:

> Hi,
> 
> Has anyone managed to get Protobuf output logged through Telegraf? Telegraf is supposed to support Protobuf input but I’m getting the following error:
> 
> … E! [inputs.socket_listener] Unable to parse incoming line: proto: cannot parse invalid wire-format data
> 
> The Telegraf config I’m using:
> 
> [[inputs.socket_listener]]
>   ## Protobuf listener for RPZ matched query logging
>   service_address = "tcp://127.0.0.1:8000"
>   data_format = "xpath_protobuf"
>   xpath_protobuf_type = "PBDNSMessage"
>   xpath_protobuf_file = "/etc/telegraf/dnsmessage.proto"
>   xpath_print_document = true
> 
> I’m aware of a Protobuf listener written in Go that can output to InfluxDB, but I was hoping to avoid another piece of software when we’re already running Telegraf for the pdns-recursor stats. I just want to add logging of RPZ filtered queries.
> 
> Thanks,
> Djerk

The protobuf streams add a framing header of two bytes of length per protobuf message.
The receiving side has to take that into account.

The dnstap streams use the framestream format. In the recursor, they
are only implented to report on outgoing queries and their replies though,.

	-Otto