[AGDNS 4226] Create query-log-streaming.md - #470
Conversation
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
|
||
| Events are collected and delivered in periodic, compressed batches; delivery timing depends on traffic volume (see the [*Delivery garantees and limitations*](#delivery-guarantees-and-limitations) section for details). | ||
|
|
||
| AdGuard DNS supports streaming logs exclusively to S3-compatible storage in its current version. You can then ingest these logs into your SIEM or analytics pipeline using your own tooling and connectors. |
There was a problem hiding this comment.
Эта строка будто повторяет первое предложение другими словами. может убрать?
|
|
||
| ### Is the delivery of every single event guaranteed? | ||
|
|
||
| Yes. Under the “at-least-once” delivery model, network retries triggered by transient outages can cause duplicate log events to be written to the bucket. The ingestion pipeline or SIEM must be configured to handle deduplication. |
There was a problem hiding this comment.
Этот ответ дословно совпадает с ответом на следующий вопрос (Are duplicate events possible…), похоже, при правке сюда случайно попал не тот текст. Потерялась ключевая оговорка про возможный дроп событий при долгой недоступности бакета, которая есть в разделе Delivery guarantees (Unreachable destination), сейчас FAQ этому противоречит.
Предлагаю вернуть: Yes, under normal operating conditions. However, if the destination bucket becomes unreachable, log events may eventually be dropped once the retry buffer limit is exceeded - see Delivery guarantees and limitations for details.
|
|
||
| ### What happens if Enterprise status is lost? | ||
|
|
||
| Log streaming is strictly an Enterprise-tier feature. If the account downgrades or the subscription lapses, the streaming service will be automatically deactivated. |
There was a problem hiding this comment.
предлагаю избегать формулировки даунгрейд - If the account is no longer on an Enterprise plan or the subscription lapses, the streaming service will be deactivated automatically.
|
|
||
| *Query log streaming* lets AdGuard DNS Enterprise users automatically export raw DNS query events to their own external, S3-compatible storage — without relying on manual API polling. Once exported, these logs can be ingested into SIEM systems, SOC platforms, data lakes, or internal analytics pipelines, giving you programmatic access to raw query data for security monitoring, auditing, and compliance. | ||
|
|
||
| Events are collected and delivered in periodic, compressed batches; delivery timing depends on traffic volume (see the [*Delivery garantees and limitations*](#delivery-guarantees-and-limitations) section for details). |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
|
||
| - **Enterprise plan:** This feature is strictly available to AdGuard DNS Enterprise users. If the account is no longer on an Enterprise plan, the log streaming service will be deactivated. For voluntary deactivation, see the FAQ below. | ||
| - **Active query log:** Your AdGuard DNS configuration must have query logging enabled. | ||
| - **S3-Compatible bucket:** You must have an active, writeable bucket on Amazon S3 or another S3-compatible cloud storage provider (e.g., Cloudflare R2, Backblaze B2, Google Cloud Storage, Wasabi, or MinIO). |
There was a problem hiding this comment.
Давайте уберем Google Cloud Storage из списка и из FAQ тоже - у него нет нативного S3 API. S3-совместимость реализована через отдельный XML-слой с отдельным типом ключей (HMAC, не обычные project-креды) и другим endpoint, то есть обычный access key/secret key из Step 1 для него просто не сработает без дополнительной настройки на стороне клиента, которую мы нигде не описываем.
|
|
||
| Once the request is approved, the support team will provide further instructions and request the specific configuration parameters required to establish the log stream. | ||
|
|
||
| ### Step 4: Stream activation |
There was a problem hiding this comment.
А это корректно, что заголовки первых трех шагов в повелительном наклонении, а последний шаг нет?
| ### Missing fields in the logs | ||
|
|
||
| **Potential cause:** Specific logging or privacy features (such as client IP logging or device metadata collection) are disabled in your AdGuard DNS dashboard settings. | ||
| * |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
|
||
| ### Can storage options other than S3 be used? | ||
|
|
||
| No. Currently, only S3-compatible storage is supported. Standard options include Amazon S3 or compatible offerings from other cloud providers (e.g., Cloudflare R2, Google Cloud Storage, Backblaze B2, Wasabi, or MinIO). Native integration with other storage types (such as direct Azure Blob or SFTP) is not available at this time. |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
1 similar comment
|
Preview was deployed to: https://pull-request-470.kb-dns.pages.dev/ |
3 participants
No description provided.