Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

ON THIS PAGE

DNS Request Filtering System Logging Error Messages

 

The message format for system logs related to DNS request filtering differs slightly for the Next Gen Services MX-SPC3 services card versus early services cards. This topic describes the differences in the DNS request filtering related system log messages and provides a description of all fields in these messages.

System Logging for DNS Request Filtering Overview

Next Gen Services DNS request filtering system logging generates these events:

  1. DNS match events (DNS_SR_MATCH_EVENT)

    1. A single syslog is generated for each DNS match to the list of filtered domains.

  2. Per-term statistics (DNS_SR_CUSTOMER_STATS)

    1. Each term in the template represents a customer, enabling you to collect per-customer statistics.

    2. You can configure the interval in which you want to collect statistics in each template.

  3. You can report an event each time a DNS blacklist file is added or updated (DNS_SR_FILE_UPDATE_NOTICE)

  4. You can collect per-PIC Summary report statistics (DNS_SR_REPORT_STATS)

    1. Statistics are generated every 5 minutes. This interval value is not configurable.

    2. These stats are generated per-PIC basis.

      Note

      To enable these logs you must configure a syslog for each service-set for which you’ve configured dns-filtering.

      All system log messages for Next Gen Services are configured at the service-set level using the following statement:

      To collect DNS request filtering system log messages, include urlf in the local-category statement:

  5. You can collect per-client IP statistics (DNS_SR_CLIENT_IP_STATS)

    1. This statistics are generated per-profile.

    2. The interval for collecting these statistics is configurable per-profile.

DNS Match-Event Syslog Format

Note

System system log messages for Next Gen Services DNS request filtering doesn’t include the FPC slot/PIC slot and UTC time.

Table 1 describes the fields contained in DNS request filtering match events.

Table 1: DNS-Match-Event Syslog Format

Field Name

Description

Example

Time Stamp

Time when log entry was generated

Oct 27 10:04:19

Router Name

Host name of the router generating the record

Jnpr-router-01

Log Handle

Log handle to identify the log category

junos-url-filter

Match

Indicates a DNS match was detected.

JSERVICES_URLF_MATCH_EVENT: DNS_SR_MATCH_EVENT

Tag

Log-prefix configured

Tag=<value>

svc-set-name

Service-set name

svc-set-name=<value>

ID

ID assigned to the domain name

(Size of ID is assumed to be a 32-bit number)

ID=12345

IP_Src

Source IP

IP_Src=10.1.5.72

IP_Dst

Destination IP (DNS resolver)

IP_Dst=10.1.1.10

Src_Prt

Source Port

Src_Prt=37344

Dst_Prt

Destination Port

Dst_Prt=53

Sinkhole_IP

IP of sinkhole server from Domain Name Input List

Sinkhole_IP=10.1.50.64

Sinkhole_IPv6

IP of IPv6 sinkhole server from Domain

Name Input List

Sinkhole_IPv6=8001:1002:

1003:1004:1005:1006:1007:1008

Sinkhole_fqdn

Sinkhole FQDN

Sinkhole_fqdn=NA

Count

Counter for match events to accommodate identical event records

Count=54

Replaced

Designates replacement of response domain (i.e. sinkholing)

Replaced=Y

Reason_Mask

Reason for action (if Replaced=N)

[See table below for bit position enumeration]

Reason_Mask=0x0

QType

Query Type of the DNS request (A, AAAA, MX, CNAME, SRV, TXT)

QType=A

Profile

Profile Name

[The Web filter profile name as configured]

Profile=profile_01

Template

Template Name

[The DNS filter template name as configured]

Template=template_01

Term

Term Name

[The DNS filter term name as configured]

Term=term_01

Time

UNIX timestamp

Time=Wed Dec 20 12:25:24 2017

Here’s an example of MX-SPC3 DNS filtering syslog format:

Feb 20 17:06:36 ce-bras-mx480-o junos-url-filter: JSERVICES_URLF_MATCH_EVENT: DNS_SR_MATCH_EVENT, Tag=tag, svc-set-name= s1, ID=1235, IP_SRC=2.2.2.3, IP_DST=101.10.10.100, SRC_PRT=34342, DST_PRT=53, Sinkhole_IP=1.1.1.1, Sinkhole_IPv6=NA, Sinkhole_fqdn=NA, Count=9, Replaced=Y, Reason_Mask=0x0, QType=A, Profile=webf-prof-1, Template=dnsf-temp-1, Term=dnsf-term-1, Time=Tue Jan 23 13:45:52 2018

Here’s an example of MS-MPC DNS filtering syslog format:

Jan 23 13:45:52 cliq (FPC Slot 1, PIC Slot 1) 2018-01-23 21:45:52: {s1}[jservices-urlf]: JSERVICES_URLF_MATCH_EVENT: DNS_SR_MATCH_EVENT ID=1235, IP_SRC=2.2.2.3, IP_DST=101.10.10.100, SRC_PRT=34342, DST_PRT=53, Sinkhole_IP=1.1.1.1, Sinkhole_IPv6=NA, Sinkhole_fqdn=NA, Count=9, Replaced=Y, Reason_Mask=0x0, QType=A, Profile=webf-prof-1, Template=dnsf-temp-1, Term=dnsf-term-1, Time=Tue Jan 23 13:45:52 2018

Reason Mask Values & Interpretations for DNS Filtering

Table 2 describes the reason mask value fields and interpretations for MX Next Gen Services DNS filtering.

Table 2: Reason Mask Values & Interpretations for DNS Filtering

Bit Position

Hex Value

Interpretation

Additional Comments

0x0

Replaced

0

0x1

Reason Other

Examples:Fragmented packets, malformed packets

1

0x2

Not a supported DNS request type

Examples: SRV, TXT

2

0x4

Indicator action set to “Report-Only”

This is to enable testing of new indicators before putting them into Production.

3

0x8

Replace A/AAAA record error

4

0x10

Replacement information not available

The domain name entry is marked “replace” but the sinkhole-ip/sinkhole-ipv6/sinkhole-fqdn is not provided.

Here’s an example of MX Next Gen Services syslog format for DNS filtering showing the reason mask and interpretation:

Feb 20 17:06:36 ce-bras-mx480-o junos-url-filter: JSERVICES_URLF_MATCH_EVENT: DNS_SR_MATCH_EVENT, Tag=tag, svc-set-name= s1, ID=1235, IP_SRC=2.2.2.3, IP_DST=101.10.10.100, SRC_PRT=34342, DST_PRT=53, Sinkhole_IP=1.1.1.1, Sinkhole_IPv6=NA, Sinkhole_fqdn=NA, Count=9, Replaced=Y, Reason_Mask=0x0, QType=A, Profile=webf-prof-1, Template=dnsf-temp-1, Term=dnsf-term-1, Time=Tue Jan 23 13:45:52 2018

Here’s an example of MS-MPC DNS filtering syslog format:

Jan 23 13:45:52 cliq (FPC Slot 1, PIC Slot 1) 2018-01-23 21:45:52: {s1}[jservices-urlf]: JSERVICES_URLF_MATCH_EVENT: DNS_SR_MATCH_EVENT ID=1235, IP_SRC=2.2.2.3, IP_DST=101.10.10.100, SRC_PRT=34342, DST_PRT=53, Sinkhole_IP=1.1.1.1, Sinkhole_IPv6=NA, Sinkhole_fqdn=NA, Count=9, Replaced=Y, Reason_Mask=0x0, QType=A, Profile=webf-prof-1, Template=dnsf-temp-1, Term=dnsf-term-1, Time=Tue Jan 23 13:45:52 2018

Per-Term Statistics Syslog Format

Table 3 describes the fields for MX Next Gen Services DNS filtering per-term statistics syslog format.

Table 3: Per-Term Statistics Syslog Format

Field Name

Description

Example

Time Stamp

Time when log entry was generated

Oct 27 10:04:17

Router Name

Host name of the router generating the record

Jnpr-router-01

Log Handle

Log handle to identify the log category

junos-url-filter

Match

A term(customer) statistics record

JSERVICES_URLF_CUSTOMER_STATS: DNS_SR_CUSTOMER_STATS

Tag

Log-prefix configured

Tag=<value>

svc-set-name

Service-set name

svc-set-name=<value>

Profile

Profile Name

[The Web filter profile name as configured]

Profile=profile_01

Template

Template Name

[The DNS filter template name as configured]

Template=template_01

Term

Term Name

[The DNS filter term name as configured]

Term=term_01

Packets_Processed

Total DNS Requests Processed

Requests_Processed=200

DNS_UDP_Packets_Processed

DNS UDP Requests Processed

DNS_UDP_Requests_Processed=98

DNS_TCP_Packets_Processed

DNS TCP Requests Processed

DNS_TCP_Requests_Processed=35

DNS_UDP_Requests_sinkholed

DNS UDP Requests sink-holed

DNS_UDP_Requests_Sinkholed =50

DNS_TCP_Requests_sinkholed

DNS TCP Requests sink-holed

DNS_TCP_Requests_Sinkholed =50

DNS_UDP_Requests_reported

DNS UDP Requests reported

DNS_UDP_Requests_Reported =50

DNS_TCP_Requests_reported

DNS TCP Requests reported

DNS_TCP_Requests_Reported =50

Time

UNIX timestamp

Time=Wed Dec 20 12:25:24 2017

Count

Counter to accommodate identical event records

Count=10

Here’s an example of MX-SPC3 DNS filtering syslog format for per-term statistics:

Feb 25 14:25:45 curve junos-url-filter: JSERVICES_URLF_CUSTOMER_STATS: DNS_SR_CUSTOMER_STATS, Tag , svc-set-name s1, Profile=DNS_CUSTOMER-A, Template=DNS_CUSTOMER-A, Term=DNS_CUSTOMER-A, Requests_Processed=0, DNS_UDP_Requests_Processed=0, DNS_TCP_Requests_Processed=0, DNS_UDP_Requests_Sinkholed=0, DNS_TCP_Requests_Sinkholed=0, DNS_UDP_Requests_Reported=0, DNS_TCP_Requests_Reported=0, Time=Mon Feb 25 14:25:45 2019, Count=13

Here’s an example of MS-MPC DNS filtering syslog format:

Mar 8 12:16:05 iphone3gs (FPC Slot 5, PIC Slot 0) 2019-03-08 20:16:04: {ATT-Zone5}[jservices-urlf]: JSERVICES_URLF_CUSTOMER_STATS: DNS_SR_CUSTOMER_STATS, Profile=ATT-Profile-5-Zone5, Template=ATT-Profile-5-Zone5-Area1, Term=ATT-Profile-5-Zone5-Area1-Customer3, Requests_Processed=0, DNS_UDP_Requests_Processed=0, DNS_TCP_Requests_Processed=0, DNS_UDP_Requests_Sinkholed=0, DNS_TCP_Requests_Sinkholed=0, DNS_UDP_Requests_Reported=0, DNS_TCP_Requests_Reported=0, Time=Fri Mar 08 12:16:05 2019, Count=111

DNS Filtering Blacklist File Add/Change Syslog Format

Table 4 describes the fields for MX Next Gen Services DNS filtering blacklist file additions and updates syslog format.

Table 4: Blacklist File Add/Change Syslog Format

Field Name

Description

Example

Time Stamp

Time when log entry was generated

Oct 27 10:04:17

Router Name

Host name of the router generating the record

Jnpr-router-01

Log Handle

Log handle to identify the log category

junos-url-filter

Match

The domain blacklist file updated for the template.

.

JSERVICES_URLF_FILE_UPDATE_NOTICE: DNS_SR_FILE_UPDATE_NOTICE

Tag

Log-prefix configured

Tag=<value>

svc-set-name

Service-set name

svc-set-name=<value>

File Name

Name of the file

File_Name=shdb.txt

File Version

Version of the file

File_Version=20170314_01

Updated

File Update Time

Domain_Filter_File_Updated=Fri Oct 27 10:56:42 2017

Profile

Profile Name

[The Web filter profile name as configured]

Profile=profile_01

Template

Template Name

[The DNS filter template name as configured]

Template=template_01

Domains

Number of Domains in the file

Domains=12

Report-Only-Domains

Number of Report-Only domains in the file

Report_Only_Domains=3

Here’s an example of the syslog format for MX-SPC3 DNS filtering blacklist add/change file updates:

Feb 25 14:36:47 curve junos-url-filter: JSERVICES_URLF_FILE_UPDATE_NOTICE: DNS_SR_FILE_UPDATE_NOTICE, Tag=, svc-set-name=s1, File_Name=test_dns_sink.txt, File_Version=20180911 01, Domain_Filter_File_Updated=Mon Feb 25 14:36:47 2019 Profile=DNS_CUSTOMER-A, Template=DNS_CUSTOMER-A, Domains=18, Report_Only_Domains=0

Here’s an example of the syslog format for DNS filtering blacklist file changes with the MS-MPC services card:

Jan 23 13:34:34 cliq (FPC Slot 1, PIC Slot 1) 2018-01-23 21:34:33: {s1}[jservices-urlf]: JSERVICES_URLF_FILE_UPDATE_NOTICE: DNS_SR_FILE_UPDATE_NOTICE, File_Name=dnsf1_hashed.txt, File_Version=20170314_01, Domain_Filter_File_Updated=Tue Jan 23 13:34:34 2018 Profile=webf-prof-1, Template=dnsf-temp-1, Domains=4, Report_Only_Domains=1

DNS Filtering Summary Report Statistics Syslog Format

Summary report statistics syslog format Stats will be reported in syslog with the following format:

Here’s an example summary report syslog message for MX-SPC3 Next Gen Services DNS filtering:

Feb 25 11:50:39 curve junos-url-filter: JSERVICES_URLF_REPORT_STATS: DNS_SR_REPORT_STATS, Tag=, svc-set-name=s1, TCP_DNS_Packets=0, TCP_DNS_Non_Segmented=0, TCP_DNS_Segmented=0, Count=1

Here’s an example summary report syslog message for MS-MPC services card DNS filtering:

Mar 8 12:20:41 iphone3gs (FPC Slot 5, PIC Slot 1) 2019-03-08 20:20:40: {ATT-Zone1}[jservices-urlf]: JSERVICES_URLF_REPORT_STATS: DNS_SR_REPORT_STATS, TCP_DNS_Packets=0, TCP_DNS_Non_Segmented=0, TCP_DNS_Segmented=0, Count=169

DNS Filtering Per-Client-IP Statistics Syslog Format

Table 5 describes the syslog fields for MX-SPC3 DNS filtering per-client-IP statistics that is reported per-PIC, per-profile for all known client IP addresses known to the system.

Table 5: Per-Client-IP Statistics Syslog Format

Field Name

Description

Example

Time Stamp

Time when log entry was generated

Oct 27 10:04:17

Router Name

Host name of the router generating the record

Jnpr-router-01

Log Handle

Log handle to identify the log category

junos-url-filter

Match

Log for per-Client IP stats

JSERVICES_URLF_CLIENT_IP_STATS: DNS_SR_CLIENT_IP_STATS

Tag

Log-prefix configured

Tag=<value>

svc-set-name

Service-set name

svc-set-name=<value>

Client-IP

IP address of the client

Client-IP=1.1.1.1

Profile

Profile Name

[The Web filter profile name as configured]

Profile=profile_01

Template

Template Name

[The DNS filter template name as configured]

Template=template_01

Term

Term Name

[The DNS filter term name as configured]

Term=term_01

A_Req

DNS A-Record Requests Processed

A_Req=10

AAAA_Req

DNS AAAA-Record Requests Processed

AAAA_Req=10

MX_Req

DNS MX-Record Requests Processed

MX_Req=4

CNAME_Req

DNS CNAME-Record Requests Processed

CNAME_Req=4

SRV_Req

DNS SRV-Record Requests Processed

SRV_Req=4

TXT_Req

DNS TXT-Record Requests Processed

TXT_Req=4

ANY_Req

DNS ANY-Record Requests Processed

ANY_Req=4

A_Req_SH

DNS A-Record Requests sink-holed

A_Req_SH =5

AAAA_Req_SH

DNS AAAA-Record Requests sink-holed

AAAA_Req_SH=5

MX_Req_SH

DNS MX-Record Requests Sink-holed

MX_Req_SH=4

CNAME_Req_SH

DNS CNAME-Record Requests Sink-holed

CNAME_Req_SH=4

SRV_Req_SH

DNS SRV-Record Requests Sink-holed

SRV_Req_SH=4

TXT_Req_SH

DNS TXT-Record Requests Sink-holed

TXT_Req_SH=4

ANY_Req_SH

DNS ANY-Record Requests Sink-holed

ANY_Req_SH=4

Req_Rep

DNS Requests reported

Req_Rep=5

Here’s an example per-client-IP-statitics for MX-SPC3 DNS filtering:

Feb 25 11:50:39 curve junos-url-filter: JSERVICES_URLF_CLIENT_IP_STATS: DNS_SR_CLIENT_IP_STATS, Tag=tag, svc-set-name=s1, Client-IP=2.2.2.3, Profile=webf-prof-1, Template=dnsf-temp-1, Term=dnsf-term-1, A_Req=0, AAAA_Req=0, MX_Req=0, CNAME_Req=0, SRV_Req=0, TXT_Req=0, ANY_Req=2, A_Req_SH=0, AAAA_Req_SH=0, MX_Req_SH=0, CNAME_Req_SH=0, SRV_Req_SH=0, TXT_Req_SH=0, ANY_Req_SH=0, Req_Rep=2

Here’s an example syslog message for DNS filtering client-IP statistics on MS-MPC services cards:

Mar 7 17:58:54 iphone3gs (FPC Slot 5, PIC Slot 3) 2019-03-08 01:58:54: {dns}[jservices-urlf]: JSERVICES_URLF_CLIENT_IP_STATS: DNS_SR_CLIENT_IP_STATS, Client-IP=2004:db0:2228:8001::1, Profile=dns-profile1, Template=dns1, Term=3, A_Req=19, AAAA_Req=19, MX_Req=0, CNAME_Req=0, SRV_Req=0, TXT_Req=0, ANY_Req=0, A_Req_SH=19, AAAA_Req_SH=19, MX_Req_SH=0, CNAME_Req_SH=0, SRV_Req_SH=0, TXT_Req_SH=0, ANY_Req_SH=0, Req_Rep=0

Related Documentation