If it is the same People that benchmark WEF and tell the 10kx10k story i Will definitely avoid following this advice...
Logging folks, next time a Windows admin tells you they cannot enable any DNS logging due to 'performance reasons'. "There is no apparent performance impact for query rates of 50,000 QPS and lower" https://blogs.technet.microsoft.com/teamdhcp/2015/11/23/network-forensics-with-windows-dns-analytical-logging/ … Please retweet. Don't let some myth hold us back!
-
-
-
Really? I've found the WEF performance numbers to be very reasonable... I'd love to know if there's something we need to be aware of.
- Još 2 druga odgovora
Novi razgovor -
-
-
Meanwhile, I have goons telling me I‘m not allowed to disable firewall logging of DNS requests. Firewall logs of DNS provide zero retrospective value for anybody. Can’t log the real client (internal caching resolver), domain looked up, or the response. They just clutter my drive.
-
Monitor DNS traffic via firewall is great for outbound blocks. Your clients should be using *your* official DNS server, nothing else. If you have logging troubles I feel bad for you son, I got 99 logging problems, but a goon ain't one!
- Još 2 druga odgovora
Novi razgovor -
-
-
Or as an alternative, put a network tap on all dns server links and log with Zeek/bro.
-
HUGE fan of this method. Sometimes it's not an option. Also, it makes me upset how often the cries of "but mah performance" is made by admins who *should* know better, forcing this option.
Kraj razgovora
Novi razgovor -
-
-
Tweet je nedostupan.
-
My point is this MSFT article shows they'd have to be running at 90% or higher load for native logging to be non-viable. If you're that hot all the time, *anything* causes an outage. "NO!! Don't launch notepad!!!!!" BSOD.
Kraj razgovora
-
-
-
Double the volume, it's still reasonable. (same source) "A DNS server running on modern hardware that is receiving 100,000 queries per second (QPS) can experience a performance degradation of 5% when analytic logs are enabled."
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
but my domain controller also runs exchange and Quake. I don't care about email slowing down, but i'll be damned if my ping rates increase
-
Also I hope I don’t overload my pizza server
- Još 2 druga odgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.