Skip to main content
DNZ logs every DNS query it answers: the name and type, the status, who answered it (a local zone, an upstream, the cache, a blocklist), the client’s address and how long it took. Use the log to check that a record is being used, to find a client that keeps asking for a missing name, or to see why a site is blocked.

​
Open the query log

Open DNS → Query Logs. Viewing it needs the logs.read permission.
  • Type in Filter by name or client to search.
  • Turn on Live to refresh the list every 5 seconds, or click Refresh.

​
This division and All queries

By default the page shows this division’s queries. Each query belongs to one division:
  • a name in a local zone belongs to the zone’s division, whoever asked;
  • any other query (forwarded, cached or blocked) belongs to the division whose client network holds the client, for example 10.10.0.0/16 → SIMRS.
A query from a client in no client network belongs to no division, so only All queries (here and on the Overview) shows it. Add your networks under DNS → Filtering → Client networks so a division’s log and Overview count its own devices’ traffic.
Queries logged before DNZ placed forwarded queries by client network keep no division, so a division’s history before the upgrade only has the names in its zones.
Superadmins also get a Scope switch. All queries shows every query the server answered, including clients in no client network. Both scopes have a source filter, also opened from the Overview’s Answered by:
  • All sources
  • Local zones: answered from your zones (and DNS64)
  • Forwarded: sent to an upstream, a forwarding rule or safe search
  • Cache: answered from the cache (fresh or stale)
  • Blocked: every blocked query (blocklists and RPZ), with the client’s IP (see Filtering)
  • Errors

​
From the command line

See CLI: monitoring for every option. Scripts can also read a division’s log over the API with a token that has logs.read: GET /api/divisions/{id}/logs?q=&source=&limit=, and its traffic summary from GET /api/divisions/{id}/stats?range=24h (see API overview).

​
How long data is kept

DNZ keeps three kinds of data: Queries are written to the log in batches, and rows older than the retention period are deleted. Top names and clients are counted as queries come in, so the dashboard reads a few thousand rows instead of the whole log. After an upgrade to a version that has them, DNZ rolls up the log it already has in the background, the newest hour first. Change the period in the config file or the environment:
/etc/dnz/dnz.toml
/etc/dnz/dnz.env
The top names and clients in dnz stats come from the query log, so they cover at most log_retention_days, even when you ask for --range 90d. The counts come from the hourly totals and cover the whole range.

Monitoring

Usage charts, upstream health and alerts on the Overview.

Notifications

NXDOMAIN spikes, rate limiting and a daily summary.