Skip to main content
Version: 3.18 (latest)

Configure DNS logs

Calico Enterprise pushes DNS activity logs to Elasticsearch, for DNS information that is obtained from trusted DNS servers. The following table details the key/value pairs in the JSON blob, including their Elasticsearch datatype. This information should assist you in constructing queries.

NameDatatypeDescription
start_timedateWhen the collection of the log began in UNIX timestamp format.
end_timedateWhen the collection of the log concluded in UNIX timestamp format.
typekeywordThis field contains one of the following values:
 LOG: Indicates that this is a normal DNS activity log.
 UNLOGGED: Indicates that this log is reporting DNS activity that could not be logged in detail because of DNSLogsFilePerNodeLimit.
countlongWhen type is:
 LOG: How many DNS lookups there were, during the log collection interval, with details matching this log.
 UNLOGGED: The number of DNS responses that could not be logged in detail because of DNSLogsFilePerNodeLimit. In this case none of the following fields are provided.
client_ipipThe IP address of the client pod. A null value indicates aggregation.
client_namekeyword

This field contains one of the following values:
 The name of the client pod.
 -: the name of the pod was aggregated. Check client_name_aggr for the pod name prefix.

client_name_aggrkeywordThe aggregated name of the client pod.
client_namespacekeywordNamespace of the client pod.
client_labelsarray of keywordsLabels applied to the client pod. With aggregation, the label name/value pairs that are common to all aggregated clients.
qnamekeywordThe domain name that was looked up.
qtypekeywordThe type of the DNS query (e.g. A, AAAA).
qclasskeywordThe class of the DNS query (e.g. IN).
rcodekeywordThe result code of the DNS query response (e.g. NoError, NXDomain).
rrsetsnestedDetailed DNS query response data - see below.
serversnestedDetails of the DNS servers that provided this response.
latency_countlongThe number of lookups for which latency was measured. (The same as count above, unless some DNS requests were missed, or latency reporting is disabled - see dnsLogsLatency in the FelixConfiguration resource.)
latency_meanlongMean latency, in nanoseconds.
latency_maxlongMax latency, in nanoseconds.

Each nested rrsets object contains response data for a particular name and a particular type and class of response information. Its key/value pairs are as follows.

NameDatatypeDescription
namekeywordThe domain name that this information is for.
typekeywordThe type of the information (e.g. A, AAAA).
classkeywordThe class of the information (e.g. IN).
rdataarray of keywordsArray of data, for the name, of that type and class. For example, when type is A, this is an array of IPs for name.

Each nested servers object provides details of a DNS server that provided the information in the containing log. Its key/value pairs are as follows.

NameDatatypeDescription
ipipThe IP address of the DNS server.
namekeyword

This field contains one of the following values:
 The name of the DNS server pod.
 -: the DNS server is not a pod.

name_aggrkeyword

This field contains one of the following values:
 The aggregated name of the DNS server pod.
 pvt: the DNS server is not a pod. Its IP address belongs to a private subnet.
 pub: the DNS server is not a pod. Its IP address does not belong to a private subnet. It is probably on the public internet.

namespacekeywordNamespace of the DNS server pod, or - if the DNS server is not a pod.
labelsarray of keywordsLabels applied to the DNS server pod or host endpoint; empty if there are no labels or the DNS server is not a pod or host endpoint.

The latency_* fields provide information about the latency of the DNS lookups that contributed to this log. For each successful DNS lookup Calico Enterprise measures the time between when the DNS request was sent and when the corresponding DNS response was received.

Query DNS log fields

After a set of DNS logs has accumulated in Elasticsearch, you can perform many interesting queries. For example, if you query on:

  • qname, you can find all of the DNS response information that was provided to clients trying to resolve a particular domain name

  • rrsets.rdata, you can find all of the DNS lookups that included a particular IP address in their response data.