---
title: "Logging"
canonical: "https://docs.infoblox.com/space/DeploymentGuideDNSInfrastructureProtection/1869938698/Logging"
format: markdown
---
By default, when a DNS attack is detected against an enabled rule, the appliance generates a log message. These DNS Infrastructure Protection messages are displayed in CEF (Common Event Format).  
The number of log messages generated is based on the 'Event per Second' setting in each rule. For example, if the setting is 5, the appliance generates maximum of five log messages of the same event per second per client when a rule is hit within the time duration. Following is a sample CEF log message for a DNS Infrastructure Protection rule hit event,

  
2019-08-09 12:46:35 PDT daemon ERROR threat-protect-log[6524] CEF:0|Infoblox|NIOS Threat|8.4.4-386831|120601966|Potential DDoS related domain: ontrees.com|7|src=10.61.19.13 spt=51460 dst=10.61.19.55 dpt=53 act="DROP" cat="Potential DDoS related Domains" nat=0 nfpt=0 nlpt=0 fqdn=ontrees.com hit_count=4981

  
This log contains the following information:

- The timestamp when the event happened in yyyy-mm-ddThh:mm:ss+00:00 format.
- Infoblox|NIOS Threat|x.x.x: Indicates the Infoblox product, and x.x.x represents the NIOS version.
- The number following the NIOS version is the rule ID. In this example, it is 120601966.
- Following the rule ID is the rule name specified in the rule. In this example it is “Potential DDoS related domain: ontrees.com”
- The number following the rule ID is the log severity. The following numbers indicate the severity levels:
  - 8 = Critical
  - 7 = Major
  - 6 = Warning
  - 4 = Informational
- src: Source IP address
- spt: Source port.
- dst: Destination IP address.
- dpt: Destination port.
- act: The rule action, which can be ALERT, DROP, or PASS, depending on the rule configuration.
- cat: The rule category to which the rule belongs. In this example, the rule category is “Potential DDoS related Domains
- nat: Indicates if the syslog event is logged for a NAT'ed client. In this example, nat=0 means that it's not a NAT’ed client.
- nfpt: Indicates the first port in the port block if syslog is for NAT’ed client.
- nlpt: Indicates the last port in the port block if syslog is for NAT’ed client.
- fqdn: Indicates the FQDN that was queried by the client
- hit_count: Indicates the number of rule hits

The logs for DNS Infrastructure Protection appliance can be viewed by going to;

**Administration > Logs > Syslog**
Select the appropriate member from the Member drop down menu.

![image-20251124-072355.png](media://f133ce63-9176-4867-b7e9-32b70427bc7b)

To view DNS Infrastructure Protection logs, click on **Show filter**

![image-20251124-111502.png](media://4c785319-6b9b-4e76-83d4-2e49987b23a9)

Select the values of the filter fields as “**Server equals DNS Infrastructure Protection**” shown in the screenshot below,

![image-20251201-112304.png](media://ff3b69ab-20b8-4349-bb5d-31d0ed5bb16a)


To only view CEF messages logged for DNS Infrastructure Protection Rules hit,  
Select **Threat Detection Event Logs** from Quick Filter drop down menu, after selecting the appropriate member in Syslog,

![image-20251124-113909.png](media://69ca6448-82dc-41d6-ae4a-8e4cf734040e)

![image-20251124-113934.png](media://05e98418-855f-4ba7-95d3-01bbfda8a081)


Click **Apply**

The filters can be used to view different levels of log messages, such as CRITICAL, ALERT, INFO, etc.The critical messages can be viewed by setting the filter settings as shown in the screenshot below,

![image-20251124-114029.png](media://da837514-9d65-441e-b6c4-5f2d46d99b96)

A DNS amplification attack is a reflection-based distributed denial of service (DDoS) attack.

The attacker spoofs client requests to DNS servers to hide the true source of the attacker and direct the response to the client. Using various techniques, small DNS queries may be turned into a much larger payloaddirected at the target network. The following log message has rule id of 130400100. This rule first warns if anysource IP sends UDP DNS packets that contain possible reflection/amplification attacks.

![image-20251124-120851.png](media://883c0d08-2301-4b1b-af67-50c4735ee524)

In order to view the rule that is being hit to generate the above log message,

Go to **Data Management > Security > DNS Infrastructure Protection Rules**

Click on the Active ruleset for the Grid and in **Go to** field type the rule id **130400100**. Click **Go**

![image-20251201-112648.png](media://9472bdfe-4724-41fb-9ef9-c05b9cc42ecd)


The following log message is generated when DNS Infrastructure Protection receives large ICMP ping packet.

![image-20251124-121324.png](media://256bdcf9-3335-48ab-a8f2-4a140af1e5af)

The following log message is generated when DNS Infrastructure Protection receive drops request to a malicious domain.

![image-20251124-121410.png](media://0fe74397-e520-4205-8120-357a4abe810c)