Great Tool -is dnssniffer + Dns Filter How to get this work?

[ToniToga]

The go-dns-collector is a great tool, exactly what i looked for. But I have one Problem.
I cannot get the DNS-Filter get to work. Perhabs because I'm using the dnssniffer to get the DNS-Logs.
Am I right?
My Goal is to filter some Domain names, which shouldn't get logged.

My config looks like:

global:
  trace:
    verbose: true

multiplexer:
  collectors:
    - name: dnssniff
      dns-sniffer:
        port: 53
        device: eth0
        capture-dns-queries: true
        capture-dns-replies: true
        cache-support: true
        query-timeout: 5.0

  transforms:
    filtering:
      drop-domain-file: "/etc/dnscollector/exceptions"
      drop-fqdn-file: "/etc/dnscollector/exceptions2"
      log-queries: true
      log-replies: true

  loggers:
    - name: loki
      lokiclient:
        server-url: "http://XYZ.Intern.de:3100/loki/api/v1/push"
        job-name: "dnscollector"
        text-format: "localtime identity qr queryip family protocol qname qtype rcode"

  routes:
    - from: [dnssniff]
      to: [loki]

[dmachard]

Hi,

If working fine with the following config in my side.
Can you retry by redirecting to the console in first ?

multiplexer:
  collectors:
    - name: sniff
      dns-sniffer:
        port: 53
        device: wlp2s0
        capture-dns-queries: true
        capture-dns-replies: true
        cache-support: true
        query-timeout: 5.0
      transforms:
        filtering:
          drop-fqdn-file: "./testsdata/filtering_fqdn.txt"
          log-queries: false
          log-replies: true

  loggers:
    - name: console
      stdout:
        mode: text

  routes:
    - from: [ sniff ]
      to: [ console ]

[ToniToga]

Hi, thx for your answer.
I tried it exactly like you, but it's not working. I also tried every kind of format in my drop-fqdn-file.
When I log into my console, it's not filtering the suggested entrys/queries!
For me it looks like the transforms section is not executed. Perhabs my drop-fqdn-file is wrong? Is there a way to extend the Log, so I can get more information about the transforms -Part?

greetings

The normal Log is just logging this:

INFO: 2022/09/06 13:37:58.844812 main - version 0.21.0
INFO: 2022/09/06 13:37:58.844892 main - config loaded...
INFO: 2022/09/06 13:37:58.844894 main - starting dns-collector...
INFO: 2022/09/06 13:37:58.845028 [console] logger stdout - enabled
INFO: 2022/09/06 13:37:58.845155 [dnssniff] sniffer collector - enabled
INFO: 2022/09/06 13:37:58.845350 main - running all collectors and loggers...
INFO: 2022/09/06 13:37:58.845412 [console] logger to stdout - running in background...
INFO: 2022/09/06 13:37:58.845453 [dnssniff] sniffer collector - starting collector...
INFO: 2022/09/06 13:37:58.857518 [dnssniff] processor dns - initialization...
INFO: 2022/09/06 13:37:58.857630 [dnssniff] dns processor - dns cached enabled: false
INFO: 2022/09/06 13:37:58.857730 [dnssniff] dns processor - running... waiting incoming dns message
INFO: 2022/09/06 13:38:00.917777 main - system interrupt, exiting...
INFO: 2022/09/06 13:38:00.917812 main - stopping all collectors and loggers...
INFO: 2022/09/06 13:38:00.917816 [dnssniff] sniffer collector - stopping...
INFO: 2022/09/06 13:38:00.917829 [dnssniff] sniffer collector - run terminated
INFO: 2022/09/06 13:38:00.917842 [console] logger to stdout - stopping...
INFO: 2022/09/06 13:38:00.917844 [console] logger to stdout - closing channel
INFO: 2022/09/06 13:38:00.917853 [console] logger to stdout - run terminated

[dmachard]

can you share your drop-fqdn-file ?

[ToniToga]

It is just a txt File called exceptions.txt and the content is only one Line.

elastic.localnet.de

I tried to get the DNS-Filter working on two different Ubuntu-Systems, but in both cases the filter is not working.
did I made a misstake with my exceptions.txt File?

greetings

[ToniToga]

I also tried to use a IP drop file but this is also not working. Is there a way to extend logging to see why it is not loading the exceptions/filtering Files?
greetings

[dmachard]

Hi @ToniToga
A fix will be integrated in next release #405