dsc has two major components (described below): Collector and
Presenter. The tool uses a CGI script to display data in a web browser. The
interface allows user to change time scales, to select particular nodes within
a DNS server cluster, and to isolate individual dataset keys.
A detailed
manual
is available.
Collector
The collector process uses libpcap
to recieve DNS messages sent and received on a network interface. It may run on
the same machine as the DNS server, or on another system connected to a switch
configured with port mirroring. A configuration file defines some number of
datasets and other options. Datasets are dumped to disk every 60 seconds as XML
files. A cron job copies the XML files to a separate server for archiving and
further processing.
Presenter
This component receives XML datasets from collectors. Since parsing XML files
is slower than we'd like, an extractor process converts them to another format.
Currently that format is a line-based text file, although we may use a
relational database in the future.