Category: TA_technitium_dns

I have revised my Technitium DNS Add-on to fix a problem with ingestion of JSON logs. I also updated and added some refreshes to the dashboard.

I noticed some unusual reporting on the dashboard yesterday and discovered that the dns.json file was sometimes being ignored. Splunk was reporting an error monitoring the file:

ERROR TailReader [1423568 tailreader0] - File will not be read, seekptr checksum did not match (file=/var/log/technitium/dns/dns.json). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

I increased the initCrcLength to 2048 and the problem was solved. Installing this update will cause all of the log files to be re-ingested, so if you have v0.1.0 installed, you will want to move any ingested log files somewhere else before pushing this update to your forwarder.

The dashboard was updated to do refreshes at 2-minute intervals. Not all the panels were refreshing, so I added refreshes where necessary.

The add-on has been updated on Splunkbase.

My Technitium Add-on was approved and is now available on Splunkbase.

I invite comments on the features and functionality in your environments, so please try it and let me know what you like, what doesn’t work and what features you would like to see.

I have released the WayneWare Add-on for Technitium DNS today. This initial version performs field extraction for all query records and assigns source types for the various categories of events that the server produces.

The add-on is only available for *nix and is written for a normal (non-container) installation of the server.

There is a dashboard included. I invite comments as to what additional features the dashboard can include.