Page Comparison

Infoblox Platform logs are delivered in parquet format. You can use the Apache parquet tools that Infoblox provides (click here to access the tools) to convert the parquet files to JSON format if necessary. For more information, see Converting Parquet to JSON.

...

Answers count

...

{“opcode”:0,”timestamp”:1525857674,”qname”:”exampledomain.com.”,”qtype”:1,”qclass”:1,”source”:
“3b9eea03015cee5cca1bcb22b02c837c”“3b9xxx03015xca1xxx22b02c837c”,”qip”:”192.0.2.1″,”qport”:47″3b9eea03015cee5cca1bcb22b02c837c”47″3b9xxx03015cee5xca1bcb22b02c837c”,”qip”:”192.0.2.2″,”qport”:47697,”rip”:”
“,”rport”:-1,”protocol”:17,”delay”:1.0,”rcode”:3,”type”:1,”qqr”:false,”qaa”:false,”qtc”:false,”qrd”:false,”qra”:false,
“qad”:false,”qcd”:false,”qdo”:false,”rqr”:true,”raa”:false,”rtc”:false,”rrd”:true,”rra”:false,”rad”:true,”rcd”:false,
“rdo”:false,”rrr1″:{},”rrr2″:{},”rrr3″:{},”view”:””,”anonymized”:false,”nanosec”:220087857,”pid”:”120873″,
“cid”:”:c4f0717dbd1150904aab042e1843a91f”c4f0717dxx1150904axx042e1843a91f”,”tid”:””}

RPZ Logs

For RPZ  data, the following directory structure is required:

Amazon S3 > <bucketname> /archivers/ rpz_enriched / year=xxxx / month=xx / day=xx /hour=xx

Example:

Amazon S3 > testbucket/rpz_enriched /year=2024/month=3/day=3/hour=15/ 

File format: part-00000-0228fa58-6334-464c-8502-37f04dd40528.c000.snappy.parquet

RPZ

...

{“opcode”:-1,”timestamp”:1521522768,”nanosec”:0,”tcode”:0,”tname”:”exampledomain.co.base.rpz.infoblox.local”,”acode”:3,”arrtype”:-1,”arrdata”:””,”qname”:”exampledomain.com”,”qtype”:1,”qclass”:-1,”source”:””,”qip”:”192.0.2.1″,”qport”:39826,”rip”:”192.0.2.2″,”rport”:-1,”view”:”_default”,”pvendor”:”Infoblox”,”pname”:”NIOS”,”pversion”:”8.2.0-357775″,”loglevel”:7,”disabled”:false,”tid”:””,”pid”:””,”cid”:””,”anonymized”:false,”cmac”:””,”csite”:””,”qcat”:””,”tinfo”:””}

...

java -jar parquet-tools-1.10.1-SNAPSHOT.jar cat -j ipmeta_Update_1521240816_0000000000_01965.parquet

{“opcode”:2,”source”:”192.0.2.1″,”timestamp”:1521535044,”nanosec”:0,”cip”:”192.0.2.2″,”hostnames”:{},”usernames”:{“array”:[{“name”:”frtest”,”actfrom”:1521238758,”actto”:1521534479}]},”mac”:””,”view”:”default”,”fingerprint”:””,”os”:””,”firstts”:-1,”lastts”:-1,”extattrs”:{},”anonymized”:false}

...