# Gathering only DNS Logs

**URL:** <https://community.zeek.org/t/gathering-only-dns-logs/6449>\
**Category:** Zeek\
**Tags:** dns, logging\
**Created:** [February 12, 2022, 3:20am UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449 "2022-02-12T03:20:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason\_R](https://avatars.discourse-cdn.com/v4/letter/b/839c29/32.png) [@Blason\_R](https://community.zeek.org/u/Blason_R)\
**Post date:** [February 12, 2022, 3:20am UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/1 "2022-02-12T03:20:20Z")

</div>

Hi Team,

I have zeek installed on my DNS server and I need to collect only dns.log. I am struggling to find that configuration where I could stop monitoring all other protocols and wanted to monitor only the dns protocol.

Can someone please help?

TIA  
Blason R

---

<div class="post-metadata">

**Author:** ![Blason\_R](https://avatars.discourse-cdn.com/v4/letter/b/839c29/32.png) [@Blason\_R](https://community.zeek.org/u/Blason_R)\
**Post date:** [February 12, 2022, 3:23am UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/2 "2022-02-12T03:23:22Z")

</div>

Is this the file which should be modified?

/opt/zeek/share/zeek/base/init-default.zeek

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [February 12, 2022, 3:28am UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/3 "2022-02-12T03:28:52Z")

</div>

Yes.

You should be able to comment out all protocol analyzers with exception to dns.

**Patrick Kelley, CISSP, C|EH, ITIL**  
_CTO_  
[patrick.kelley@criticalpathsecurity.com](mailto:patrick.kelley@criticalpathsecurity.com)

---

<div class="post-metadata">

**Author:** ![Blason\_R](https://avatars.discourse-cdn.com/v4/letter/b/839c29/32.png) [@Blason\_R](https://community.zeek.org/u/Blason_R)\
**Post date:** [February 12, 2022, 4:14am UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/4 "2022-02-12T04:14:51Z")

</div>

Yes - I did that however service was refused to start. Any clue is much appreciated.

Feb 12 09:43:59 ubuntu-test systemd[1]: zeek.service: Scheduled restart job, restart counter is at 22.  
– Subject: Automatic restarting of a unit has been scheduled  
– Defined-By: systemd  
– Support: [http://www.ubuntu.com/support](http://www.ubuntu.com/support)

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [February 14, 2022, 5:41pm UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/5 "2022-02-14T17:41:10Z")

</div>

I’ll work out the proper configuration in my lab environment and get back to you.

**Patrick Kelley, CISSP, C|EH, ITIL**  
_CTO_  
[patrick.kelley@criticalpathsecurity.com](mailto:patrick.kelley@criticalpathsecurity.com)

---

<div class="post-metadata">

**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\
**Post date:** [February 16, 2022, 2:37pm UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/6 "2022-02-16T14:37:51Z")

</div>

Blason,

The attached /usr/local/zeek/share/zeek/base/init-default.zeek worked fine for me.

I used a base zeek version 5.0.0-dev.114 install for testing.

Let me know if this doesn’t work for you.

[zeek-dns-only.txt](https://community.zeek.org/uploads/short-url/5I13iwjzrTRwpcuUSu8wSciWV8J.txt) (2.35 KB)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/gathering-only-dns-logs/6449/7 "2022-05-06T15:47:50Z")

</div>