DNSTAP overload condition logging

Carsten Strotmann carsten at strotmann.de
Fri Nov 19 05:50:20 UTC 2021


Hi,

how can a BIND 9 operator detect an DNSTAP overload condition?

My understanding is that BIND 9 worker threads write DNSTAP 
information
into a circular buffer in memory, which is that read by a 
different
thread to write out the data (to file or socket).

Is there any indication to the user (log message, marker in DNSTAP 
data)
in the situation where BIND 9 receives more DNSTAP events than it 
could
write out, so that older events get overwritten in the buffer?

I've read dnstap.c and I could not find a hint, but I've could 
missed
it.

Greetings

Carsten


More information about the bind-users mailing list