Best way to intercept dnsmasq query logs

Question

I have a Dnsmasq server, on which I want to parse query logs to be able to build stats based on queries / responses.

The Dnsmasq provides two logging mechanisms:

• By default, it logs to syslog
• If a path is given, it logs into the file found at the given path

If dnsmasq is logging into syslog

Is there a clean way to "watch" syslog to receive every new line sent by dnsmasq?

If dnsmasq is logging to a file

Would a fifo be a proper solution for dnsmasq logging proxying?

Some issues arise with a fifo created by mkfifo:

• If we don't want dnsmasq's death to kill the reader process, we need to have another, dummy, process holding a write FD, which is a pain to "automate".
• If we don't want the reader process' death to break the fifo logging, we need another, dummy, reader process that will just ignore every content.
• We need to make sure at all times that the fifo stays up and available.
• If we still want to have dnsmasq's logs, which we probably do, we are forced to either write a custom /var/log/dnsmasq.log file or somehow send logs to syslog while disguising ourselves as dnsmasq.

In short

If one wants to properly be notified on new Dnsmasq query / answer without risking interrupting the default dnsmasq mechanisms or adding too much complexity, what would be the best approach?

Answer 1

You can roll your own, possibly by combining tail + awk as in here.

Otherwise, the combination of syslog and fail2ban works for this. It doesn't add huge amount of complexity, and those two components are well-known and widely available.

Syslog will manage all redirection to a file and the necessary log file management. Even a single user browsing the web will generate a lot of DNS lookups. A syslog-daemon can manage this without hiccup and will cover all practical issues you'll run into, such as maximum filesize, file rotation for fresh files in a certain frequency, maximum amount of log files.

Fail2ban is typically used to add IP's to iptables/nftables based on log file contents. However, it works fine as a platform to monitor files and performs scripted actions when triggered. It uses regexes to filter through log files in search of whatever you're interested in and run an action when the regex matches. You can make it perform whatever action you want it to perform, including e.g. calling a python script you wrote. It also has functionality to perform an action after a timer has passed, which may or may not be useful in your use case.