matty9191 / bind-query-log-statistics Goto Github PK

"""
# Bind 9.11
04-Jun-2018 14:48:15.540 queries: info: client @0x7fda1d74e7d0 \
192.168.1.6#60844 (prefetch.net): query: prefetch.net IN A +E(0)D \
(192.168.1.250)
"""
    elif len(chopped) == 10:
        timestamp = chopped[0] + " " + chopped[1]
        """ Had to change the item reference in chopped[] below because they added a memory location
             in the middle of everything, instead of putting it at the end
        """
        client_ip = chopped[3].split("#")[0]
        """ That also shifted the rr_type over
        """
        rr_type = chopped[7]
        dns_question = chopped[4]

elif len(chopped) == 10:
    timestamp = chopped[0] + " " + chopped[1]
    client_ip = chopped[3].split("#")[0]
    rr_type = chopped[7]
    dns_question = chopped[5]

# python /var/tmp/bind-query-log-stats.py --count 10 /var/log/dns/query.log
Processing logfile /var/log/dns/query.log

<skip>

Top  ['10']  DNS names requested:
Traceback (most recent call last):
  File "/var/tmp/bind-query-log-stats.py", line 265, in <module>
    print_top_dns_requests(COUNT)
  File "/var/tmp/bind-query-log-stats.py", line 97, in print_top_dns_requests
    for query, _ in Counter(DNS_QUERIES).most_common(num_print):
  File "/usr/lib64/python2.7/collections.py", line 462, in most_common
    return _heapq.nlargest(n, self.iteritems(), key=_itemgetter(1))
  File "/usr/lib64/python2.7/heapq.py", line 465, in nlargest
    result = _nlargest(n, it)
TypeError: an integer is required

Processing logfile /var/log/bind9/query.log

Summary for 18-Jan-2018 07:54:51.603 - 18-Jan-2018 08:32:27.532

Total DNS_QUERIES processed : 2583
  +E     records requested : 2583

Top  100  DNS names requested:
  IN : 2583

Top  100  DNS clients:
Traceback (most recent call last):
  File "./bind-query-log-stats.py", line 268, in <module>
    print_top_dns_clients(COUNT)
  File "./bind-query-log-stats.py", line 105, in print_top_dns_clients
    client_name = socket.gethostbyaddr(client_ip)[0]
socket.gaierror: [Errno -2] Name or service not known

18-Jan-2018 08:36:30.387 client 173.90.213.148#9307 (edu.za): query: edu.za IN ANY +E (172.31.7.30)