After you set up your Data Connector virtual appliance, you must set up certain configuration so the Data Connector can gather relevant information from the Grid members, and then send the data to the Infoblox reporting server or Infoblox cloud destination.

When configuring the Grid to capture DNS queries and responses, you can choose to save the capture file locally on your appliance, or configure an SCP (Secure Copy) server and provide the credentials for the users configured on the Data Connector.

A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. The capture file is automatically saved and exported to an SCP server based on your configuration. When you configure the appliance to save the capture file locally and later enable SCP, the appliance copies all the data starting with the oldest data. Infoblox recommends that you constantly monitor the SCP server to ensure that it has sufficient disk space. DNS queries and responses are stored on the appliance if the SCP server becomes unreachable. The maximum storage capacity varies based on the appliance model. After reaching the maximum limit, the appliance overwrites the old data with the new one. For information about the maximum hard drive space, see Maximum Hard Drive Space used for DNS queries and Responses. The amount of data captured depends on the DNS query rate and the domains that are included in or excluded from the capture. For information about how to exclude domains, see Viewing Registered Data Connector Details.

Capturing DNS Queries

You can capture queries to all domains or limit the capture to specific domains. You can also apply the Bulk Add Domains feature to tailor query capture to a desired subset of domains or zones. When capturing DNS queries, NIOS matches the specified domain name(s) and everything that belongs to the domain. For example, when you specify ‘foo.com’ as the domain, NIOS captures queries sent to ‘foo.com’, ‘mail.foo.com', and ‘ftp.foo.com’. NIOS captures queries to domains for which a name server is authoritative and also captures recursive queries. Note that this feature does not support wildcard characters or regular expressions. 

Capturing DNS Responses

You can capture DNS responses for the DNS queries sent to the server. The amount of data captured depends on the domains that are included in or excluded from the capture. A DNS response is based on a query generated for a domain. In the response message, NIOS captures the TTL value of a resource record, the resource record type, and the resource data.

The following are characteristics of the response messages:

• They log only the answer section and do not include the authority and additional sections.
• Responses to all queries are logged, including queries with the type "ANY".
• The RR (resource record) list is not available at the end of a response message if the record has a value other than NOERROR or if the response is NOERROR (nodata).
• Responses to all RR types, including those records not managed by NIOS such as HINFO records, are logged. However, there are few exceptions for some of the scenarios with DNSSEC records.
• Responses containing DNSSEC RRs (DNSKEY, DS, NSEC, NSEC3, NSEC3PARAM, RRSIG) when queried for non-DNSSEC RRs are not logged. However, responses are logged if a DNSSEC RR is explicitly queried.
• DNS updates are not logged in responses.

Configuring DNS Queries and Responses on NIOS

To configure DNS queries and responses, complete the following:

1. Grid: From the Data Management tab, select the DNS tab, expand the Toolbar and click Grid DNS Properties.
2. Member: From the Data Management tab, select the DNS tab and click the Members tab -> member check box -> Edit icon.
3. In the Grid DNS Properties or Member DNS Properties editor, click Toggle Advanced Mode and select the Logging tab.
4. Under Data Connection for all DNS Queries/Responses to a Domain, complete the following:

• Select the Capture DNS Queries check box to start capturing DNS queries. This enables the feature set for configuration. When you enable this option at the member level, the appliance captures DNS queries for the selected members only.

• Select the Capture DNS Responses check box to start capturing DNS responses. This enables the feature set for configuration. When you enable this option at the member level, the appliance captures DNS responses for the selected members only.

  Note

  Enabling the logging of queries and responses at the same time can increase disk space usage and adversely affect DNS services and performance. Infoblox recommends that you do not configure both logging at the same time.

• Select Capture queries/responses for all domains to capture queries and responses to all domains and zones.
• Select Limit capture to these domains to capture DNS queries and responses to domains and zones one at a time.
  
• Specify domains for DNS capture operations in the Domain table by clicking the Add icon, and choosing Add Domain or Bulk Add Domains from the menu.
• Retain captured queries on the local disk: Select this check box to save the DNS queries on the appliance. In addition to the local disk, you can select to export the DNS queries to the Data Connector by selecting SCP in the Export to drop-down list.

  • Export to: From the drop-down list, select SCP to back up the DNS queries on the Data Connector and None to save queries only on the appliance. To save the captured DNS queries on both the appliance and the Data Connector, select the Retain captured queries on the local disk check box and SCP from the Export to drop-down list.
    To define the destination for capture files, perform the following:

    Note

    When you configure an SCP server and enable the MGMT port, the NIOS appliance uses SSH for data transfer. It uses the same authentication and provides the same security as SSH. SCP uses the LAN1 port to communicate with the external servers.

• When you select SCP from the Export to drop-down list, complete the following:
  • In the Directory Path field, enter the directory to which the capture file will be saved on the server. Infoblox recommends that you use the ~ symbol for the Data Connector VM.
  • In the Server Address field, enter the IP address of the Data Connector VM to which the capture files will be saved.
  • Enter the file server account Username and Password values.
• Limit query data collected per file to minutes or 100MB (whichever comes first): This option limits the collection of query data per capture file. A capture file for logging DNS queries and responses is rolled over based on the configured time limit or when the file reaches 100 MB in size, whichever is sooner. The default time limit is 10 minutes. You can enter a value from 1 to 10. 

5. Save the configuration.