# Disable dns.log **URL:** \ **Category:** Zeek\ **Created:** [December 17, 2021, 9:23pm UTC](https://community.zeek.org/t/disable-dns-log/6433 "2021-12-17T21:23:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\ **Post date:** [December 17, 2021, 9:23pm UTC](https://community.zeek.org/t/disable-dns-log/6433/1 "2021-12-17T21:23:13Z")
My company runs Zeek on an Arm embedded device and we would like to minimize the CPU load from Zeek. Is there any way to disable the dns.log, we do not use it. Thanks Gary **Gary Huband** _Sr. Software and Systems Engineer_ Office: 434.284.8071 x720 Direct: 434.260.4995 [Gary@MissionSecure.com](mailto:Gary@MissionSecure.com) **Follow Us!** [LinkedIn](https://www.linkedin.com/company/mission-secure-inc-) | [Blog](https://www.missionsecure.com/blog?utm_source=email-signature&utm_medium=email&utm_campaign=blog-email-sig) | [Website](https://www.missionsecure.com/?utm_source=email-signature&utm_medium=email&utm_campaign=web-email-sig) : : : : : : : : : : : : : : : : : : : : : : : : : : : ![MSi](http://www.missionsecure.com/images/MSi_Logo_email.png) This email and any files transmitted with it are confidential and proprietary and intended solely for the use of the individual or entity to whom they are addressed. Any dissemination, distribution or copying of this communication is strictly prohibited without our prior permission. If you received this in error, please contact the sender and delete the material from any computer. ---
**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\ **Post date:** [December 17, 2021, 11:30pm UTC](https://community.zeek.org/t/disable-dns-log/6433/2 "2021-12-17T23:30:05Z")
Hi Gary, You have multiple options here. You can disable the DNS log, but that'd mean that internal DNS-related processing still happens. Therefore it's likely more effective to have Zeek ignore DNS traffic, unless you have other reasons to look at it. The following little script suppresses DNS via a BPF packet filter, and also suppresses the log. ---
**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\ **Post date:** [December 17, 2021, 11:36pm UTC](https://community.zeek.org/t/disable-dns-log/6433/3 "2021-12-17T23:36:08Z")
This may work also [Analyzer::disable\_analyzer](https://github.com/zeek/zeek/blob/master/scripts/base/frameworks/analyzer/main.zeek#L160-L163)[](https://docs.zeek.org/en/master/scripts/base/frameworks/analyzer/main.zeek.html#id-Analyzer::disable\_analyzer) [https://github.com/zeek/zeek/blob/master/scripts/base/frameworks/analyzer/main.zeek#L160-L163](https://github.com/zeek/zeek/blob/master/scripts/base/frameworks/analyzer/main.zeek#L160-L163) ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [December 18, 2021, 12:20am UTC](https://community.zeek.org/t/disable-dns-log/6433/4 "2021-12-18T00:20:23Z")
Here’s another way you can do it. Put the following in no-dns.zeek: ```auto @unload base/protocols/dns/main @load base/init-default.zeek ``` and then run `zeek -b no-dns.zeek …` — Vern ---
**Author:** ![Ankith\_Kumar\_Hanuman](https://avatars.discourse-cdn.com/v4/letter/a/f04885/32.png) [@Ankith\_Kumar\_Hanuman](https://community.zeek.org/u/Ankith_Kumar_Hanuman)\ **Post date:** [December 20, 2021, 4:20pm UTC](https://community.zeek.org/t/disable-dns-log/6433/5 "2021-12-20T16:20:56Z")
Thanks for the quick replies. Both of these methods worked: Method 1: redef PacketFilter::restricted\_filter = “not port 53”; event zeek\_init() { Log::disable\_stream(DNS::LOG); } Method 2: event zeek\_init() { Analyzer::disable\_analyzer(Analyzer::ANALYZER\_DNS); } Are there any advantages for one over the other? Thanks Gary **Gary Huband** _Sr. Software and Systems Engineer_ Office: 434.284.8071 x720 Direct: 434.260.4995 [Gary@MissionSecure.com](mailto:Gary@MissionSecure.com) **Follow Us!** [LinkedIn](https://www.linkedin.com/company/mission-secure-inc-) | [Blog](https://www.missionsecure.com/blog?utm_source=email-signature&utm_medium=email&utm_campaign=blog-email-sig) | [Website](https://www.missionsecure.com/?utm_source=email-signature&utm_medium=email&utm_campaign=web-email-sig) : : : : : : : : : : : : : : : : : : : : : : : : : : : ![MSi](http://www.missionsecure.com/images/MSi_Logo_email.png) This email and any files transmitted with it are confidential and proprietary and intended solely for the use of the individual or entity to whom they are addressed. Any dissemination, distribution or copying of this communication is strictly prohibited without our prior permission. If you received this in error, please contact the sender and delete the material from any computer. ---
**Author:** ![Neslog](https://avatars.discourse-cdn.com/v4/letter/n/7cd45c/32.png) [@Neslog](https://community.zeek.org/u/Neslog)\ **Post date:** [December 20, 2021, 4:39pm UTC](https://community.zeek.org/t/disable-dns-log/6433/6 "2021-12-20T16:39:07Z")
I found disabling analyzer will save processing. That said, intel framework will not alert on dns iocs ---
**Author:** ![bofh139](https://avatars.discourse-cdn.com/v4/letter/b/b38774/32.png) [@bofh139](https://community.zeek.org/u/bofh139)\ **Post date:** [December 21, 2021, 6:10pm UTC](https://community.zeek.org/t/disable-dns-log/6433/7 "2021-12-21T18:10:24Z")
Just remember the above examples filter the port number not just DNS, so if somebody is using port 53 for CnC or a tunnel it will not be detected. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/disable-dns-log/6433/8 "2022-05-06T15:47:49Z")