LogInsight DNS queries - How to minimize?

[oergmann]

Hi all,

Loginsight Appliance 4.5 is generating a large number of DNS queries. Is it possible to disable IPv6 Queries or VM queries for example or change the way it caches DNS queries? Any idea?

Best regards

Jörg

[daphnissov]

Hi, Jörg, could you share some more information on how you detected these? Don't have a solution, but am genuinely curious to know more about this situation.

[oergmann]

If a check the logging I see a lot of request for IPv4, IPv6. 4 request every few seconds, two for IPv6 (one with domain suffix and one without) and two for IPv4 (one with domain suffix and one without).

[RonnyNorway]

loginsight itself shouldnt generate a lot of DNS queries, as it would cache up the entries/responses when it needs to resolve an address.

Are you sure you are not looking at the DNS logs themselves and are seeing other systems queries for DNS resolution