dnstap monitoring

dnstap.conf

#
# /etc/unbound/unbound.conf.d/dnstap.conf
#

dnstap:
    dnstap-enable: yes
    dnstap-socket-path: "/var/log/dnstap/.sock"
    dnstap-send-identity: yes
    dnstap-send-version: yes
    dnstap-log-client-query-messages: yes
    dnstap-log-client-response-messages: yes

dnstap_rotate

#
# /etc/cron.daily/dnstap_rotate
#

@monthly root systemctl kill --kill-who=main --signal=SIGUSR1 fstrm_capture 2>&1

fstrm_capture.service

#
# /etc/systemd/system/fstrm_capture.service
#

[Unit]
Description=fstrm_capture server
Before=unbound.service

[Service]
Type=simple
User=unbound
Group=unbound
ExecStart=/usr/bin/fstrm_capture --type protobuf:dnstap.Dnstap --unix /var/log/dnstap/.sock --localtime -w /var/log/dnstap/dnstap.%%Y%%m%%d.%%H%%M.%%s
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target