Home > User Interface > Auditing > DNS Audit Logs

DNS Audit Logs

Menu path: Auditing.

This page provides a display of the logs maintained for DNS request and response messages.

The general format and usage of this page is discussed in General GUI Usage.

The elements of the page are:

Audit Messages
Advanced Search

Audit Messages

The view offers selectable columns (with the symbol); the initial default columns are:

Created At
IP Address
MAC Address
Qname
Answer

DNS log entries can be searched with a Simple Search or Advanced Search, based on the position of the slider. Simple searches consist of a search for IP or MAC address, whereas advanced searches use multiple search conditions.

Clicking on any entry displays information about that log entry, as discussed in DNS Log Entry.

DNS Log Entry

The DNS log entry columns that may be selected with the icon are shown below. Selecting an individual log entry will display the data for that entry in three tabs:


Label	Usage
Created At	The date and time at which the log entry was made.
ID	The identification used to match DNS requests with responses.
IP Address	The IP address of the requester.
MAC Address	The MAC address of the requester.
Qname	The query name, a potentially incomplete name.
Qtype	The query type, one of: QUERY - a standard query request STATUS - a server status query NOTIFY - a database update notification UPDATE - a dynamic database update
Scope	Local or remote scope.
Answer	The response from the DNS server.

Simple Search

The simple search choice offers a straightforward means of searching user entries:

Type any text into the Search by IP or MAC address box and press the button. Any client entry whose IP or MAC Address contains the text will be displayed in the list.
The search box and the listing are reset back to the complete list via the button.
Export to CSV - the results of the current search are saved to a file named dnslogs.csv. Previous output is not overwritten; new versions are labeled dnslogs(1).csv, dnslogs(2).csv, etc.

Advanced Search

Click the slider to access the advanced searches page. Multiple or conditions are joined together with and conjunctions. Each element of an or set may be deleted with the symbol or reordered by selecting the item's symbol. Reordering may occur across or sets.

Several facilities exist for saving and using saved searches:

In the drop-down:
- Use the Save Search choice to name and save the current search conditions.
- Previously saved searches are available in the list as well.
- Saved searches will be listed along the left-hand edge of the screen.
- The search terms may also be exported or imported in JSON format.
- the results of the current search are saved to a file named dnslogs.csv. Previous output is not overwritten; new versions are labeled dnslogs(1).csv, dnslogs(2).csv, etc.

Each condition has three parts:

Log entry property - one of the characteristics of the log entry. Choose from the full list of elements in the drop-down list.
Compare operation - one of:
- is - matches the comparison string
- is not - does not match the comparison string
- starts with - starts with the comparison string
- ends with - ends with the comparison string
- matches - the user element is matched against a regular expression (regexp). Regexp is a powerful language for expressing string matches. An introduction to regexps is found here. A simple search is the equivalent of using the matches operation with the equivalent text.

Comparison string or choice - the string or choice to match against or use as a regular expression.