You can capture DNS queries and responses for later analysis. When configuring this feature, you can choose to save the capture file locally on your appliance, as well as on the FTP (File Transfer Protocol) or SCP (Secure Copy) server. When you save it locally, you can use show query_capture to view the contents of the capture file. You can also use filter commands to exclude certain queries and view only the desired ones. Note that using multiple CLI commands to filter data for the appliances with large number of captured DNS queries and responses can significantly affect the system performance, protocol performance, and CLI command performance.
A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. The capture file is automatically saved and exported to an FTP or SCP server based on your configuration. When you configure the appliance to save the capture file locally and later enable FTP or SCP, the appliance copies all the data starting with the oldest data. Infoblox recommends that you constantly monitor the FTP or SCP server to ensure that it has sufficient disk space. DNS queries and responses are stored on the appliance if the FTP or SCP server becomes unreachable. The maximum storage capacity varies based on the appliance model. After reaching the maximum limit, the appliance overwrites the old data with the new one. For information about the maximum hard drive space, see the table below. The amount of data captured depends on the DNS query rate and the domains that are included in or excluded from the capture. For information about how to exclude domains, see Excluding Domains From Query and Response Capture.
You can also use the dnstap log format to achieve performance query logging. For information about dnstap implementation and configuring dnstap, see Configuring dnstap.
...
The following table lists the maximum hard drive space required for capturing DNS queries and responses for supported Infoblox appliance models.
Maximum Hard Drive Space used for DNS queries and Responses
...
Supported Infoblox Appliances
...
Maximum Hard Drive Space for DNS Query /Response Capture (MB)
...
Trinzic 100
...
400
...
Trinzic 815 and IB-V815
...
900
...
Trinzic 825 and IB-V825
...
3100
...
Trinzic 1415 and IB-V1415
...
6000
...
Trinzic 1425 and IB-V1425
...
10000
...
Trinzic 2215 and IB-V2215
...
12000
...
Trinzic 2225 and IB-V2225
...
28000
...
IB-VM-100
...
400
...
IB-VM-810 (120G)
...
900
...
IB-VM-820
...
3100
...
IB-VM-1410 (120G)
...
6000
...
IB-VM-1420 (120G)
...
10000
...
IB-VM-2210 (120G)
...
12000
...
IB-VM-2220 (120G)
...
28000
...
IB-VM-4010 (120G)
...
40000
...
PT-1405
...
10000
...
PT-2205
...
Excluding Domains From Query and Response Capture
...