<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">
<div dir="auto">Hello all,
<div dir="auto"><br /></div>
<div dir="auto">Having recently enabled DNSTAP on my local name server, I was wondering if there was any available Python script to read the binary log structure?</div>
<div dir="auto"><br /></div>
<div dir="auto">I managed to use “protoc” to create the Python module from the “dnstap.proto” definition as follows:</div>
<div dir="auto"><br /></div>
<div dir="auto">protoc --python_out=. dnstap.proto<br /></div>
<div dir="auto"><br /></div>
<div dir="auto">Now I have “dnstap_pb2.py” which I can import into Python3 as follows… but when I tried to “ParseFromString()”, I get an error message. Please note that “dnstap.log” below was produced by “fstrm_capture”.</div>
<div dir="auto"><br /></div>
<div dir="auto">My questions:</div>
<div dir="auto"><br /></div>
<div dir="auto">(1) Is there another way to approach this?</div>
<div dir="auto">(2) Should I consider reading directly from unix socket instead?</div>
<div dir="auto"><br /></div>
<div dir="auto">Please see output below:</div>
<div dir="auto"><br /></div>
<div dir="auto">Python 3.6.7 (default, Oct 22 2018, 11:32:17)<br />
[GCC 8.2.0] on linux<br />
Type "help", "copyright", "credits" or "license" for more information.<br />
>>><br />
>>> f = open("dnstap.log", "rb")<br />
>>> contents = f.read()<br />
>>> f.close()<br />
>>><br />
>>> import dnstap_pb2<br />
>>> a = dnstap_pb2.Dnstap()<br />
>>> a.ParseFromString(contents)<br />
Traceback (most recent call last):<br />
File "<stdin>", line 1, in <module><br />
File "/home/jsthyer/Project/dnstap.pb/google/protobuf/message.py", line 187, in ParseFromString<br />
return self.MergeFromString(serialized)<br />
File "/home/jsthyer/Project/dnstap.pb/google/protobuf/internal/python_message.py", line 1128, in MergeFromString<br />
if self._InternalParse(serialized, 0, length) != length:<br />
File "/home/jsthyer/Project/dnstap.pb/google/protobuf/internal/python_message.py", line 1180, in InternalParse<br />
buffer, new_pos, wire_type) # pylint: disable=protected-access<br />
File "/home/jsthyer/Project/dnstap.pb/google/protobuf/internal/decoder.py", line 952, in _DecodeUnknownField<br />
raise _DecodeError('Wrong wire type in tag.')<br />
google.protobuf.message.DecodeError: Wrong wire type in tag.<br /></div>
<div dir="auto"><br /></div>
<div dir="auto"><br /></div>
<div dir="auto"><br /></div>
</div>
</div>
<div name="messageSignatureSection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
<div class="matchFont">Joff</div>
</div>
</body>
</html>