juched
Very Senior Member
Hello Everyone,
I have worked on extending the Unbound stats, from currently the stats around lookup times, cache hit, etc, to also allow you to see the details on the replies happening on your network. Since I have diversion disabled, I was missing some of the reports it would generate, so this allows me to see some of the same data/
I have not made this part of the main branch as it requires logging of replies and local actions, which may have an impact on performance, so I wasn't ready to suggest that to everyone yet. However, to allow others to try, I thought I would post here what I have done, and how to set up your self for this as well.
High-level review for what I have done, yes there may be other ways to do the same, so up to you:
To do this, the following steps are what I took.
1. Create or update /jffs/configs/dnsmasq.conf.add file and insert line:
Make sure you enter your router IP. This tells DHCP to send your your router as the DNS server.
You can either reboot at the end, or run the command to restart dnsmasq:
2. Create or update /opt/share/unbound/configs/unbound.conf.add and insert lines:
The first 3 lines change the port to be the main DNS handler and open permissions for all clients on your network. The log lines enable output in a format for my script to handle and the last one just ensures extended-stats is enabled for some of the existing UI stats.
use-syslog means you need to have Scribe installed. If you don't want to use scribe, it "should" work with normal logs, just leave out that line.
3. Install the develop version of stats.
This can be done via unbound_manager. Make sure you are running the latest build of 2.18. If it shows an update is available, run the "u" command then run:
Restart unbound services using the "rs" command if it hasn't restarted yet.
At this point you should see changes to the Unbound tab under Addons in Asus-Merlin. the logs are processed at 57 minutes on the hour, and the stats are updated at 59 minutes on the hour. You may need to wait for them to run to get stats, or you can force them by running:
Top 10 blocked domains (over last 7 days):
Top 10 DNS replies with return code (over last 7 days):
Today's DNS replies - limited to 250:
I have worked on extending the Unbound stats, from currently the stats around lookup times, cache hit, etc, to also allow you to see the details on the replies happening on your network. Since I have diversion disabled, I was missing some of the reports it would generate, so this allows me to see some of the same data/
I have not made this part of the main branch as it requires logging of replies and local actions, which may have an impact on performance, so I wasn't ready to suggest that to everyone yet. However, to allow others to try, I thought I would post here what I have done, and how to set up your self for this as well.
High-level review for what I have done, yes there may be other ways to do the same, so up to you:
- Disabled dnsmasq DNS portion. Since it all just passes to unbound anyways with no diversion blocking for me, I wanted to skip the extra step. Also, this allows unbound to get the client IP, so you can see in the reports who is making the request.
- Configured unbound to allow for anyone on the network to speak to it, (not just localhost) since it needs to accept all requests from clients on the network. Also changed the port to 53 since dnsmasq is no longer the proxy for requests.
- Configured unbound to enable local-actions and replies logs. I also enabled the use of syslog-ng. This way I can get data on what was requested, and what was blocked explicitly. By using syslog-ng, it benefits from the in-memory handling of logs to not slow down unbound (as I understand syslog-ng).
- Created an hourly job to process the unbound logs, and insert them into an SQLite DB, so we can generate stats and output lists in the UI of the router. This script also cleans the unbound logs as well as removes any stats from the DB older than 7 days.
- Updated the stats script to output the new graphs and tables.
To do this, the following steps are what I took.
1. Create or update /jffs/configs/dnsmasq.conf.add file and insert line:
Code:
port=0
dhcp-option=lan,6,192.168.0.1Make sure you enter your router IP. This tells DHCP to send your your router as the DNS server.
You can either reboot at the end, or run the command to restart dnsmasq:
Code:
service restart_dnsmasq2. Create or update /opt/share/unbound/configs/unbound.conf.add and insert lines:
Code:
port: 53
interface: 0.0.0.0
access-control: 0.0.0.0/0 allow
log-replies: yes
log-local-actions: yes
log-tag-queryreply: yes
use-syslog: yes
extended-statistics: yesThe first 3 lines change the port to be the main DNS handler and open permissions for all clients on your network. The log lines enable output in a format for my script to handle and the last one just ensures extended-stats is enabled for some of the existing UI stats.
use-syslog means you need to have Scribe installed. If you don't want to use scribe, it "should" work with normal logs, just leave out that line.
3. Install the develop version of stats.
This can be done via unbound_manager. Make sure you are running the latest build of 2.18. If it shows an update is available, run the "u" command then run:
Code:
sgui devRestart unbound services using the "rs" command if it hasn't restarted yet.
At this point you should see changes to the Unbound tab under Addons in Asus-Merlin. the logs are processed at 57 minutes on the hour, and the stats are updated at 59 minutes on the hour. You may need to wait for them to run to get stats, or you can force them by running:
Code:
/jffs/addons/unbound/unbound_log.sh
/jffs/addons/unbound/unbound_stats.sh generateTop 10 blocked domains (over last 7 days):
Top 10 DNS replies with return code (over last 7 days):
Today's DNS replies - limited to 250:
Last edited:
