Show IP in Recursor Answer logs

[alihamidzadeh]

• Program: Recursor,
• Issue type: Feature request

Short description

Show IP in Answer logs

Usecase

We implement DNS logs for saving them in logcenter and analyze them for security issues.

Description

Add the "Domain-Content" field in the Answer line at PowerDNS-Recursor logs. Maybe you said we can find that IP with the dig, nslookup commands. But we want to check what IP was resolved in that request time.

I used Recursor v5.1.3 on Debian GNU/Linux 12. Currently query logs:

Dec  7 17:25:04 <VM-HOSTNAME> pdns_recursor[1506403]: msg="Question" subsystem="syncres" level="0" prio="Info" tid="2" ts="1733579704.098" ecs="" mtid="2" proto="udp" qname="google.com" qtype="A" remote="192.168.0.1:51800"
Dec  7 17:25:04 <VM-HOSTNAME> pdns_recursor[1506403]: msg="Answer" subsystem="syncres" level="0" prio="Info" tid="2" ts="1733579704.098" additional="1" answer-is-variable="0" answers="1" dotout="0" ecs="" into-packetcache="0" maxdepth="0" mtid="2" netms="0.000000" outqueries="0" proto="udp" qname="google.com" qtype="A" rcode="0" rd="1" remote="192.168.0.1:51800" tcpout="0" throttled="0" timeouts="0" totms="0.000000" validationState="Indeterminate"

It's better to include that in the logging feature. Or if it has a solution please guide me :)

Thanks for creating and developing powerful services like PowerDNS Recursor and Authoritative :))

[omoerbeek]

1. In general its is not a good idea to use text based logging for this purpose, its overhead is substantial.
2. I don't think adding the text representation is a good ideas: it can be very big per answer record, plus there can be multiple records in an answer. This would increase the overhead even more.
3. A better alternative is protobuf logging: it has been built with performance in mind and contains all the information you need. See https://docs.powerdns.com/recursor/lua-config/protobuf.html#logging-dns-messages-with-protocol-buffers

Moving this to a discussion.