Page Comparison

Table of Contents

maxLevel	2
type	flat

Introduction

The tags beginning with ddi.infoblox identify events generated by Infoblox.

Valid tags and data tables

The full tag must have 4 levels. The first two are fixed asddi.infoblox. The third level identifies the type of events sent, and the fourth level indicates the event subtype.

...

Technology

...

Brand

...

Type

...

Subtype

...

ddi

...

infoblox

audit

...

serialconsole
sshd
httpd

...

dhcp

...

dhcpd
validate_dhcpd

...

dns

...

general
client
config
dtc
lameServers
network
notify
queries
rateLimit
resolver
infobloxResponses
rpz
security
xferIn
xferOut
unknown
update
updateSecurity

...

nios

...

ntp
ntpdate
monitor
syslogNg
rabbitmq_control

These are the valid tags and corresponding data tables that will receive the parsers' data:

...

Tag

...

Data table

...

ddi.infoblox.audit.serialconsole

...

ddi.infoblox.audit.serialconsole

...

ddi.infoblox.audit.sshd

...

ddi.infoblox.audit.sshd

...

ddi.infoblox.audit.httpd

...

ddi.infoblox.audit.httpd

...

ddi.infoblox.dhcp.dhcpd

...

ddi.infoblox.dhcp.dhcpd

...

ddi.infoblox.dhcp.validate_dhcpd

...

ddi.infoblox.dhcp.validate_dhcpd

...

ddi.infoblox.dns.general

...

ddi.infoblox.dns.general

...

ddi.infoblox.dns.client

...

ddi.infoblox.dns.client

...

ddi.infoblox.dns.config

...

ddi.infoblox.dns.config

...

ddi.infoblox.dns.database

...

ddi.infoblox.dns.database

...

ddi.infoblox.dns.dtc

...

ddi.infoblox.dns.dtc

...

ddi.infoblox.dns.lame-servers

...

These are the valid tags and corresponding data tables that will receive the parsers' data:

Infoblox DNS Logging Categories

Relay rule names

DDI Infoblox - DNS Categories

DDI Infoblox - DNS Category DTC 1

DDI Infoblox - DNS Category DTC 2

DDI Infoblox - unknown DNS Categories

general

✓

client

✓

config

✓

database

✓

dnssec

✓

lame servers

✓

network

✓

notify

✓

queries

✓

rate-limit

✓

resolver

✓

responses

✓

rpz

✓

security

✓

transfer-in

✓

transfer-out

✓

update

✓

update-security

✓

DTC load balancing

✓

DTC health monitors

✓

Rules

DDI Infoblox - DNS Categories

Source Port → Customer source port, for example 13004
Source data → ^.*named\[\d*\]:\s+([\S]+):
Target Tag → ddi.infoblox.dns.\\d1
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

DDI Infoblox - DNS Category DTC 2

Source Port → Customer source port, for example 13004
Source data → ^named\[\d*\]:\s+request\s
Target Tag → ddi.infoblox.dns.dtc
Sent without syslog tag → True
Is Prefix →False (by default)
Stop processing → True

DDI Infoblox - unknown DNS Categories

Source Port → Customer source port, for example 13004
Source data → ^(?:import_)?named\[\d*\]
Target Tag → ddi.infoblox.dns.unknown
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

DDI Infoblox - DNS Category DTC 1

Source Port → Customer source port, for example 13004

Source data → ^idns_health
Product / Service
Tags
Data tables
Infoblox solutions
ddi.infoblox.audit.httpd
ddi.infoblox.dns.dtc
ddi.infoblox.audit.serial_console
ddi.infoblox.dns.config
ddi.infoblox.dns.resolver
ddi.infoblox.dns.database
ddi.infoblox.dns.queries
ddi.infoblox.dns.infoblox-responses
ddi.infoblox.dns.query-errors
ddi.infoblox.unknown.unknown
ddi.infoblox
ddi.infoblox.audit.httpd
ddi.infoblox.audit.serial_console
ddi.infoblox.audit.sshd
ddi.infoblox.audit
ddi.infoblox.audit.httpd
ddi.infoblox.audit.httpd
ddi.infoblox.audit.serial_console
ddi.infoblox.audit.serial_console
ddi.infoblox.audit.sshd
ddi.infoblox.audit.sshd
ddi.infoblox.dhcp.validate_dhcpd
ddi.infoblox.dhcp
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.validate_dhcpd
ddi.infoblox.dhcp.validate_dhcpd
ddi.infoblox.dns.
network
dtc
ddi.infoblox.dns.
network
config
ddi.infoblox.dns.
notify
database
ddi.infoblox.dns.
notify
resolver
ddi.infoblox.dns.
queries
query-errors
ddi.infoblox.dns.queries
ddi.infoblox.dns.
rate
infoblox-
limit
responses
ddi.infoblox.dns.rateLimit
ddi.infoblox.dns.resolverclient
ddi.infoblox.dns.resolverclient
ddi.infoblox.dns.infoblox-responsesconfig
ddi.infoblox.dns.infobloxResponsesconfig
ddi.infoblox.dns.rpzdatabase
ddi.infoblox.dns.rpzdatabase
ddi.infoblox.dns.securitydtc
ddi.infoblox.dns.securitydtc
ddi.infoblox.dns.xfer-ingeneral
ddi.infoblox.dns.xferIngeneral
ddi.infoblox.dns.xferinfoblox-outresponses
ddi.infoblox.dns.xferOutinfobloxResponses
ddi.infoblox.dns.unknownlame-servers
ddi.infoblox.dns.unknownlameServers
ddi.infoblox.dns.updatenetwork
ddi.infoblox.dns.updatenetwork
ddi.infoblox.dns.update-securitynotify
ddi.infoblox.dns.updateSecuritynotify
ddi.infoblox.niosdns.ntpdqueries
ddi.infoblox.niosdns.ntpdqueries
ddi.infoblox.niosdns.ntpdatequeries_responses
ddi.infoblox.niosdns.ntpdate
ddi.infoblox.nios.monitor
ddi.infoblox.nios.monitor
ddi.infoblox.nios.syslog-ngqueries_responses
Note
Union table
This is a union table that collects events from a set of tables for easy access and analysis.
Learn more about this union table in this article.
ddi.infoblox.niosdns.syslogNgqueryErrors
ddi.infoblox.niosdns.rabbitmq_controlqueryErrors
ddi.infoblox.nios.rabbitmq_controldns.rate-limit
ddi.infoblox.unknowndns.unknownrateLimit
ddi.infoblox.unknowndns.unknown

How is the data sent to Devo?

Set up the Devo relay rules

You will need to set up a rule on the relay to correctly process and forward the events received from Infoblox. In the example below, you should use any port that you can dedicate to these events.

...

Infoblox - DNS Categories

Infoblox classifies the DNS logs in different categories. You can know more about this in their documentation: Setting DNS Logging Categories. The table below depicts which Devo Relay rule would process each DNS Logging Category.

`resolver`	`ddi.infoblox.dns.resolver`
`ddi.infoblox.dns.rpz`	`ddi.infoblox.dns.rpz`
`ddi.infoblox.dns.security`	`ddi.infoblox.dns.security`
`ddi.infoblox.dns.unknown`	`ddi.infoblox.dns.unknown`
`ddi.infoblox.dns.update`	`ddi.infoblox.dns.update`
`ddi.infoblox.dns.update-security`	`ddi.infoblox.dns.updateSecurity`
`ddi.infoblox.dns.xfer-in`	`ddi.infoblox.dns.xferIn`
`ddi.infoblox.dns.xfer-out`	`ddi.infoblox.dns.xferOut`
`ddi.infoblox.nios.monitor` `ddi.infoblox.nios.ntpd` `ddi.infoblox.nios.rabbitmq_control` `ddi.infoblox.nios.syslog-ng` `ddi.infoblox.nios.update`	`ddi.infoblox.nios`
`ddi.infoblox.nios.monitor`	`ddi.infoblox.nios.monitor`
`ddi.infoblox.nios.ntpd`	`ddi.infoblox.nios.ntpd`
`ddi.infoblox.nios.ntpdate`	`ddi.infoblox.nios.ntpdate`
`ddi.infoblox.nios.rabbitmq_control`	`ddi.infoblox.nios.rabbitmq_control`
`ddi.infoblox.nios.syslog-ng`	`ddi.infoblox.nios.syslogNg`
`ddi.infoblox.unknown.unknown`	`ddi.infoblox.unknown.unknown`

How is the data sent to Devo?

Set up the Devo relay rules

You will need to set up a rule on the relay to correctly process and forward the events received from Infoblox. In the example below, you should use any port that you can dedicate to these events.

...

Infoblox - DNS Categories

Infoblox classifies the DNS logs in different categories. You can know more about this in their documentation: Setting DNS Logging Categories. The table below depicts which Devo Relay rule would process each DNS Logging Category.

Infoblox DNS Logging Categories	Relay rule names
Infoblox DNS Logging Categories	DDI Infoblox - DNS Categories	DDI Infoblox - DNS Category DTC 1	DDI Infoblox - DNS Category DTC 2	DDI Infoblox - unknown DNS Categories
general	✓
client	✓
config	✓
database	✓
dnssec				✓
lame servers	✓
network	✓
notify	✓
queries	✓
rate-limit	✓
resolver	✓
responses	✓
rpz	✓
security	✓
transfer-in	✓
transfer-out	✓
update	✓
update-security	✓
DTC load balancing			✓
DTC health monitors		✓

Rules

DDI Infoblox - DNS Categories

Source Port → Customer source port, for example 13004
Source data → ^.*named\[\d*\]:\s+([\S]+):
Target Tag → ddi.infoblox.dns.dtc\\d1
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

...

Rules

DDI Infoblox -

DHCP
DNS Category DTC 2
Source Port → Customer source port, for example 13004
Source
data → ^.*(validate_dhcpd|dhcpd)
data → ^named\[\d*\]:\s+request\s
Target Tag → ddi.infoblox.
dhcp
dns.
\\d1
dtc
Sent without syslog tag → True
Is Prefix →False (by default)
Stop processing → True
DDI Infoblox -

...

Rules

DDI Infoblox - NIOS

unknown DNS Categories

Source Port → Customer source port, for example 13004
Source data → ^(

ntpdate|monitor|ntpd|rabbitmq_control|syslog-ng)
?:import_)?named\[\d*\]
Target Tag → ddi.infoblox.
nios
dns.
\\d1
Rules
unknown
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

Infoblox - Audit

DDI Infoblox -

AUDIT
DNS Category DTC 1
Source Port → Customer source port, for example 13004
Source data →
^.*(serial_console|httpd|sshd)
^idns_health
Target Tag → ddi.infoblox.
audit
dns.
\\d1
dtc
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

Infoblox -

...

DHCP

Rules
DDI Infoblox -

unknown
DHCP
Source Port → Customer source port, for example 13004
Target
Source data → ^.*(validate_dhcpd|dhcpd)
Target Tag → ddi.infoblox.
unknown
dhcp.
unknown
\\d1
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

...

Infoblox

...

Before starting the configuration, please read the Infoblox documentation.

Setting DNS Logging Categories

Infoblox DNS logs have different categories. You can select which categories you would like to send into Devo by following these steps:

Select Data Management tab
Select the DNS tab
Click Grid DNS Properties from the Toolbar
Enable de Advanced Mode by clicking on “Toggle Expert Mode” if the editor is in the basic mode.
Select the Logging tab
Select the Logging Categories you would like to send to Devo.
Save & Close

Note
Enabling some logging categories can increase disk space usage and adversely affect DNS services and performance. Check with Infoblox whether you are recommended to logging some of these categories.

...

After saving the changes, you may be prompted to restart the DNS service for the changes to take effect.

Specifying Syslog Servers

Follow the next steps to configure your Infoblox to send messages to the Devo Relay:

...

Select the Grid tab

...

Select the Grid Manager tab

...

Select the Members tab

...

Click Grid Properties from the Toolbar.

...

Select “Log to External Syslog Servers” to enable the Infoblox appliance to send messages to a specified Syslog server.

...

Select also the “Copy Audit Log Message to Syslog” so you will be able to send audit logs to Devo.

...

To define a new Devo Relay, click the Add icon and complete the following fields:

Address: Devo Relay IP address
Transport: Secure TCP, TCP or UDP. If selecting Secure TCP, you will need to configure Stunnel in front of the Devo Relay so Stunnel will decrypt the logs and send them decrypted to the Devo Relay. Here you can read more about integrating Stunnel with the Devo Relay.
Image Removed
Interface: at your convenience.
Node ID: at your convenience.
Source: at your convenience.
Severity: at your convenience.
Port: Devo Relay port or Stunnel port listening for logs. If using the Infoblox option Transport TCP or UDP you must use the Source port of the relay rules you configured previously. If you selected Secure TCP, then you must enter the Stunnel listening port.
Logging category: you must select the option “Send selected categories” and then move to the “Selected” space all the categories you want to send to Devo. The reason for selecting the option “Send selected categories” instead of the option “Send all” is that logs will be prefixed and the Devo parsing will only work for prefixed logs of Infoblox. Read more about Infoblox log prefixes here.
Then click on the Add button and you will see the configured Devo Relay as part of the list of Syslog Servers.
Image Removed
Save & Close

...

- NIOS

Rules

DDI Infoblox - NIOS

Source Port → Customer source port, for example 13004
Source data → ^(ntpdate|monitor|ntpd|rabbitmq_control|syslog-ng)
Target Tag → ddi.infoblox.nios.\\d1
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

Infoblox - Audit

Rules

DDI Infoblox - AUDIT

Source Port → Customer source port, for example 13004
Source data → ^.*(serial_console|httpd|sshd)
Target Tag → ddi.infoblox.audit.\\d1
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

Infoblox - unknown

Rules

DDI Infoblox - unknown

Source Port → Customer source port, for example 13004
Target Tag → ddi.infoblox.unknown.unknown
Sent without syslog tag → True
Is Prefix → False (by default)
Stop processing → True

Configure Infoblox NIOS to send logs to the Relay

Before starting the configuration, please read the Infoblox documentation.

Setting DNS Logging Categories

Infoblox DNS logs have different categories. You can select which categories you would like to send into Devo by following these steps:

Select Data Management tab
Select the DNS tab
Click Grid DNS Properties from the Toolbar
Enable de Advanced Mode by clicking on “Toggle Expert Mode” if the editor is in the basic mode.
Select the Logging tab
Select the Logging Categories you would like to send to Devo.
Save & Close

Note
Enabling some logging categories can increase disk space usage and adversely affect DNS services and performance. Check with Infoblox whether you are recommended to logging some of these categories.

...

After saving the changes, you may be prompted to restart the DNS service for the changes to take effect.

Specifying Syslog Servers

Follow the next steps to configure your Infoblox to send messages to the Devo Relay:

Select the Grid tab
Select the Grid Manager tab
Select the Members tab
Click Grid Properties from the Toolbar.
In the Grid Properties editor, select the Monitoring tab. You will see a window like this below.

Image Added
Select “Log to External Syslog Servers” to enable the Infoblox appliance to send messages to a specified Syslog server.
Select also the “Copy Audit Log Message to Syslog” so you will be able to send audit logs to Devo.
To define a new Devo Relay, click the Add icon and complete the following fields:
- Address: Devo Relay IP address
- Transport: Secure TCP, TCP or UDP. If selecting Secure TCP, you will need to configure Stunnel in front of the Devo Relay so Stunnel will decrypt the logs and send them decrypted to the Devo Relay. Here you can read more about integrating Stunnel with the Devo Relay.
  Image Added
- Interface: at your convenience.
- Node ID: at your convenience.
- Source: at your convenience.
- Severity: at your convenience.
- Port: Devo Relay port or Stunnel port listening for logs. If using the Infoblox option Transport TCP or UDP you must use the Source port of the relay rules you configured previously. If you selected Secure TCP, then you must enter the Stunnel listening port.
- Logging category: you must select the option “Send selected categories” and then move to the “Selected” space all the categories you want to send to Devo. The reason for selecting the option “Send selected categories” instead of the option “Send all” is that logs will be prefixed and the Devo parsing will only work for prefixed logs of Infoblox. Read more about Infoblox log prefixes here.
- Then click on the Add button and you will see the configured Devo Relay as part of the list of Syslog Servers.
  Image Added
- Save & Close

After saving the changes, you may be required to do a service restart for the changes to take effect. Your Infoblox appliance will start to send Syslog to your Devo Relay.

Table structure

These are the fields displayed in these tables:

Rw ui tabs macro

Rw tab

title	1-6

ddi.infoblox
ddi.infoblox.audit
ddi.infoblox.audit.httpd
ddi.infoblox.audit.serial-console
ddi.infoblox.audit.sshd
ddi.infoblox.dhcp

Anchor
tag1
tag1
ddi.infoblox

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
type	`str`	vtype
subtype	`str`	vsubtype
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

Anchor
tag2
tag2
ddi.infoblox.audit

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
subtype	`str`	vsubtype
server	`str`
pid	`int4`
serverdate	`timestamp`
admin_user	`str`
action	`str`
object_type	`str`
object_name	`str`
message	`str`
srcIp	`ip4`
to	`str`
auth	`str`
admin_group	`str`
apparently_via	`str`
info	`str`
trigger_event	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

Anchor
tag3
tag3
ddi.infoblox.audit.httpd

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
serverdate	`timestamp`
admin_user	`str`
action	`str`
object_type	`str`
object_name	`str`
message	`str`
srcIp	`ip4`
to	`str`
auth	`str`
admin_group	`str`
apparently_via	`str`
info	`str`
trigger_event	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag4
tag4
ddi.infoblox.audit.serial_console

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
serverdate	`timestamp`
admin_user	`str`
action	`str`
object_type	`str`
object_name	`str`
message	`str`
srcIp	`ip4`
to	`str`
auth	`str`
admin_group	`str`
apparently_via	`str`
info	`str`
trigger_event	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag5
tag5
ddi.infoblox.audit.sshd

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag6
tag6
ddi.infoblox.dhcp

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
subtype	`str`	vsubtype
server	`str`
pid	`int4`
message	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

Rw tab

title	7-12

ddi.infoblox.dhcp.dhcpd
ddi.infoblox.dhcp.validate_dhcpd
ddi.infoblox.dns
ddi.infoblox.dns.client
ddi.infoblox.dns.config
ddi.infoblox.dns.database

Anchor
tag7
tag7
ddi.infoblox.dhcp.dhcpd

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

hostname

str

server

str

pid

int4

message_type

str

toAddress

str

toDeviceId

str

fromAddress

str

fromDeviceId

str

ofAddress

str

ofDeviceId

str

onAddress

str

onDeviceId

str

forAddress

str

forDeviceId

str

via

str

viaDeviceId

str

TransID

str

network

str

uid

str

message

str

leaseIpAddress

str

Code Block
ifthenelse(message_type in set(["DHCPACK", "DHCPOFFER", "BOOTREPLY", "DHCPEXPIRE", "RELEASE"]), ifthenelse(isnull(onAddress), toAddress, onAddress), null)

onAddress

toAddress

message_type

leaseHardwareAddress

str

Code Block
ifthenelse(message_type in set(["DHCPACK", "DHCPOFFER", "BOOTREPLY", "DHCPEXPIRE", "RELEASE"]), ifthenelse(isnull(onAddress), toDeviceId, toAddress), null)

toDeviceId

onAddress

toAddress

message_type

hostchain

str

✓

tag

str

✓

rawMessage

str

✓

Anchor
tag8
tag8
ddi.infoblox.dhcp.validate_dhcpd

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag9
tag9
ddi.infoblox.dns

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
subtype	`str`	vsubtype
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

Anchor
tag10
tag10
ddi.infoblox.dns.client

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
action	`str`
name_blacklist	`str`
query_name	`str`
client_ip	`ip4`
client_object	`str`
port	`int4`
dns_client_signer	`str`
dns_view	`str`
info	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag11
tag11
ddi.infoblox.dns.config

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag12
tag12
ddi.infoblox.dns.database

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Rw tab

title	13-18

ddi.infoblox.dns.dtc
ddi.infoblox.dns.general
ddi.infoblox.dns.infobloxResponses
ddi.infoblox.dns.lameServers
ddi.infoblox.dns.network
ddi.infoblox.dns.notify

Anchor
tag13
tag13
ddi.infoblox.dns.dtc

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag14
tag14
ddi.infoblox.dns.general

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
quota_used	`int8`
quota_max	`int8`
quota_soft_limits	`int8`
quota_s_over	`int8`
quota_hard_limit	`int8`
quota_h_over	`int8`
quota_low_pri	`int8`
dns_view	`str`
dns_view_size	`int8`
dns_view_hits	`int8`
dns_view_misses	`int8`
zone_name	`str`
zone_message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag15
tag15
ddi.infoblox.dns.infobloxResponses

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
serverdate	`timestamp`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
query_name	`str`
dns_view	`str`
protocol	`str`
class	`str`
type	`str`
response_info	`str`
rcode	`str`
flags	`str`
recursion	`bool`
authoritative_answer	`bool`
truncated_response	`bool`
edns_opt_record	`bool`
dnssec	`bool`
dnssec_records_validated	`bool`
dtc_synthetic_record	`bool`
rr_text	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag16
tag16
ddi.infoblox.dns.lameServers

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
action	`str`
query_name	`str`
type	`str`
class	`str`
client_ip	`ip4`
port	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag17
tag17
ddi.infoblox.dns.network

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_ip	`ip4`
port	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag18
tag18
ddi.infoblox.dns.notify

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
zone	`str`
class	`str`
info	`str`
serial	`int8`
client_object	`str`
client_ip	`ip4`
port	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Rw tab

title	19-24

ddi.infoblox.dns.queries
ddi.infoblox.dns.queryErrors
ddi.infoblox.dns.rateLimit
ddi.infoblox.dns.resolver
ddi.infoblox.dns.rpz
ddi.infoblox.dns.security

Anchor
tag19
tag19
ddi.infoblox.dns.queries

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
query_name	`str`
dns_view	`str`
query	`str`
class	`str`
type	`str`
flags	`str`
recursion_desired	`bool`
query_signed	`bool`
edns	`bool`
edns_version	`int4`
tcp	`bool`
dnssec	`bool`
checking_disabled	`bool`
valid_dns_server_cookie_rcv	`bool`
dns_cookie_without_valid_server_cookie	`bool`
dnsServer	`ip4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag20
tag20
ddi.infoblox.dns.queryErrors

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
query_name	`str`
dns_view	`str`
info_error	`str`
error	`str`
action	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag21
tag21
ddi.infoblox.dns.rateLimit

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`ip4`
port	`int4`
dns_client_signer	`str`
query_name	`str`
dns_view	`str`
info	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag22
tag22
ddi.infoblox.dns.resolver

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag23
tag23
ddi.infoblox.dns.rpz

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
action	`str`
zone	`str`
qname_entries	`int4`
nsdname_entries	`int4`
ip_entries	`int4`
nsip_entries	`int4`
clientip_entries	`int4`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag24
tag24
ddi.infoblox.dns.security

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
query_name	`str`
dns_view	`str`
security_info	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Rw tab

title	25-30

ddi.infoblox.dns.unknown
ddi.infoblox.dns.update
ddi.infoblox.dns.updateSecurity
ddi.infoblox.dns.xferIn
ddi.infoblox.dns.xferOut
ddi.infoblox.nios

Anchor
tag25
tag25
ddi.infoblox.dns.unknown

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag26
tag26
ddi.infoblox.dns.update

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
zone	`str`
dns_view	`str`
action	`str`
update_info	`str`
rr_action	`str`
record	`str`
type	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag27
tag27
ddi.infoblox.dns.updateSecurity

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
zone	`str`
dns_view	`str`
update_info	`str`
action	`str`
class	`str`
permission	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag28
tag28
ddi.infoblox.dns.xferIn

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
zone	`str`
class	`str`
client_ip	`str`
port	`int4`
transfer_info	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag29
tag29
ddi.infoblox.dns.xferOut

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
ib_category	`str`
message	`str`
client_object	`str`
client_ip	`str`
port	`int4`
dns_client_signer	`str`
dns_view	`str`
action	`str`
zone	`str`
class	`str`
transfer_info	`str`
type	`str`
transfer_status	`str`
since_serial	`int8`
serial	`int8`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag30
tag30
ddi.infoblox.nios

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
subtype	`str`	vsubtype
server	`str`
pid	`int4`
message	`str`
hostchain	`str`		✓
tag	`str`		✓
rawMessage	`str`		✓

Rw tab

title	31-36

ddi.infoblox.nios.monitor
ddi.infoblox.nios.ntpd
ddi.infoblox.nios.ntpdate
ddi.infoblox.nios.rabbitmq_control
ddi.infoblox.nios.syslog-ng
ddi.infoblox.unknown.unknown

Anchor
tag31
tag31
ddi.infoblox.nios.monitor

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag32
tag32
ddi.infoblox.nios.ntpd

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag33
tag33
ddi.infoblox.nios.ntpdate

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag34
tag34
ddi.infoblox.nios.rabbitmq_control

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag35
tag35
ddi.infoblox.nios.syslogNg

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Anchor
tag36
tag36
ddi.infoblox.unknown.unknown

Field	Type	Extra fields
eventdate	`timestamp`
hostname	`str`
server	`str`
pid	`int4`
message	`str`
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓

Page Comparison

Versions Compared

Old Version 7

New Version Current

Key

Introduction

Valid tags and data tables

DDI Infoblox - DNS Categories

DDI Infoblox - DNS Category DTC 2

DDI Infoblox - unknown DNS Categories

DDI Infoblox - DNS Category DTC 1

How is the data sent to Devo?

Set up the Devo relay rules

Infoblox - DNS Categories

How is the data sent to Devo?

Set up the Devo relay rules

Infoblox - DNS Categories

DDI Infoblox - DNS Categories

DDI Infoblox -

DNS Category DTC 2

DDI Infoblox -

DDI Infoblox - NIOS

unknown DNS Categories

Infoblox - Audit

DDI Infoblox -

DNS Category DTC 1

Infoblox -

DHCP

DDI Infoblox -

DHCP

Infoblox

Setting DNS Logging Categories

Specifying Syslog Servers

- NIOS

DDI Infoblox - NIOS

Infoblox - Audit

DDI Infoblox - AUDIT

Infoblox - unknown

DDI Infoblox - unknown

Configure Infoblox NIOS to send logs to the Relay

Setting DNS Logging Categories

Specifying Syslog Servers

Table structure

Anchortag1tag1ddi.infoblox

Anchortag2tag2ddi.infoblox.audit

Anchortag3tag3ddi.infoblox.audit.httpd

Anchortag4tag4ddi.infoblox.audit.serial_console

Anchortag5tag5ddi.infoblox.audit.sshd

Anchortag6tag6ddi.infoblox.dhcp

Anchortag7tag7ddi.infoblox.dhcp.dhcpd

Anchortag8tag8ddi.infoblox.dhcp.validate_dhcpd

Anchortag9tag9ddi.infoblox.dns

Anchortag10tag10ddi.infoblox.dns.client

Anchortag11tag11ddi.infoblox.dns.config

Anchortag12tag12ddi.infoblox.dns.database

Anchortag13tag13ddi.infoblox.dns.dtc

Anchortag14tag14ddi.infoblox.dns.general

Anchortag15tag15ddi.infoblox.dns.infobloxResponses

Anchortag16tag16ddi.infoblox.dns.lameServers

Anchortag17tag17ddi.infoblox.dns.network

Anchortag18tag18ddi.infoblox.dns.notify

Anchortag19tag19ddi.infoblox.dns.queries

Anchortag20tag20ddi.infoblox.dns.queryErrors

Anchortag21tag21ddi.infoblox.dns.rateLimit

Anchortag22tag22ddi.infoblox.dns.resolver

Anchortag23tag23ddi.infoblox.dns.rpz

Anchortag24tag24ddi.infoblox.dns.security

Anchortag25tag25ddi.infoblox.dns.unknown

Anchortag26tag26ddi.infoblox.dns.update

Anchortag27tag27ddi.infoblox.dns.updateSecurity

Anchortag28tag28ddi.infoblox.dns.xferIn

Anchortag29tag29ddi.infoblox.dns.xferOut

Anchortag30tag30ddi.infoblox.nios

Anchortag31tag31ddi.infoblox.nios.monitor

Anchortag32tag32ddi.infoblox.nios.ntpd

Anchortag33tag33ddi.infoblox.nios.ntpdate

Anchortag34tag34ddi.infoblox.nios.rabbitmq_control

Anchortag35tag35ddi.infoblox.nios.syslogNg

Anchortag36tag36ddi.infoblox.unknown.unknown

Anchor
tag1
tag1
ddi.infoblox

Anchor
tag2
tag2
ddi.infoblox.audit

Anchor
tag3
tag3
ddi.infoblox.audit.httpd

Anchor
tag4
tag4
ddi.infoblox.audit.serial_console

Anchor
tag5
tag5
ddi.infoblox.audit.sshd

Anchor
tag6
tag6
ddi.infoblox.dhcp

Anchor
tag7
tag7
ddi.infoblox.dhcp.dhcpd

Anchor
tag8
tag8
ddi.infoblox.dhcp.validate_dhcpd

Anchor
tag9
tag9
ddi.infoblox.dns

Anchor
tag10
tag10
ddi.infoblox.dns.client

Anchor
tag11
tag11
ddi.infoblox.dns.config

Anchor
tag12
tag12
ddi.infoblox.dns.database

Anchor
tag13
tag13
ddi.infoblox.dns.dtc

Anchor
tag14
tag14
ddi.infoblox.dns.general

Anchor
tag15
tag15
ddi.infoblox.dns.infobloxResponses

Anchor
tag16
tag16
ddi.infoblox.dns.lameServers

Anchor
tag17
tag17
ddi.infoblox.dns.network

Anchor
tag18
tag18
ddi.infoblox.dns.notify

Anchor
tag19
tag19
ddi.infoblox.dns.queries

Anchor
tag20
tag20
ddi.infoblox.dns.queryErrors

Anchor
tag21
tag21
ddi.infoblox.dns.rateLimit

Anchor
tag22
tag22
ddi.infoblox.dns.resolver

Anchor
tag23
tag23
ddi.infoblox.dns.rpz

Anchor
tag24
tag24
ddi.infoblox.dns.security

Anchor
tag25
tag25
ddi.infoblox.dns.unknown

Anchor
tag26
tag26
ddi.infoblox.dns.update

Anchor
tag27
tag27
ddi.infoblox.dns.updateSecurity

Anchor
tag28
tag28
ddi.infoblox.dns.xferIn

Anchor
tag29
tag29
ddi.infoblox.dns.xferOut

Anchor
tag30
tag30
ddi.infoblox.nios

Anchor
tag31
tag31
ddi.infoblox.nios.monitor

Anchor
tag32
tag32
ddi.infoblox.nios.ntpd

Anchor
tag33
tag33
ddi.infoblox.nios.ntpdate

Anchor
tag34
tag34
ddi.infoblox.nios.rabbitmq_control

Anchor
tag35
tag35
ddi.infoblox.nios.syslogNg

Anchor
tag36
tag36
ddi.infoblox.unknown.unknown