在CentOS 6.5 minimal系统上编译安装具有dnstap功能的BIND

在CentOS 6.5 minimal系统上编译安装具有dnstap功能的BIND

1.安装git，libtool，libsysfs

  yum install -y git libtool libsysfs

2.安装protobuf

  cd /home
  git clone https://github.com/google/protobuf
  cd protobuf
  aclocal -I m4
  ./autogen.sh
  ./configure --prefix=/usr/local/protobuf --libdir=/usr/lib
  make -j8&&make install
  ln -s /usr/local/protobuf/bin/protoc /usr/bin/

注意编译各源文件后要建立可执行程序的软连接，否则后续安装包编译时会提示缺少程序。

3.安装autoconf-2.69

  mkdir -p /usr/bin/backup
  mv /usr/bin/autoconf /usr/bin/backup
  mv /usr/bin/autoreconf /usr/bin/backup

  cd /home
  wget http://ftp.gnu.org/gnu/autoconf/autoconf-2.69.tar.gz
  tar -zxvf autoconf-2.69.tar.gz
  cd autoconf-2.69
  ./configure --prefix=/usr/local/autoconf --libdir=/usr/lib
  make -j8&&make install

  ln -s /usr/local/autoconf/bin/autoconf /usr/bin/
  ln -s /usr/local/autoconf/bin/autoreconf /usr/bin/

  autoconf --version
  autoreconf --version

注意必须使用2.64以上版本，否则后续有源文件无法编译。

4.安装gcc-4.6.1

  cd /home
  wget https://gcc.gnu.org/pub/gcc/infrastructure/gmp-4.3.2.tar.bz2
  wget https://gcc.gnu.org/pub/gcc/infrastructure/mpc-0.8.1.tar.gz
  wget https://gcc.gnu.org/pub/gcc/infrastructure/mpfr-2.4.2.tar.bz2
  wget http://ftp.gnu.org/gnu/gcc/gcc-4.6.1/gcc-4.6.1.tar.bz2
  tar -jxvf gmp-4.3.2.tar.bz2
  tar -jxvf mpfr-2.4.2.tar.bz2
  tar -zxvf mpc-0.8.1.tar.gz
  tar -jxvf gcc-4.6.1.tar.bz2

  cd /home/gmp-4.3.2
    ./configure --prefix=/usr/local/gmp --libdir=/usr/lib
  make -j8&&make install

  cd /home/mpfr-2.4.2
  ./configure --prefix=/usr/local/mpfr -with-gmp=/usr/local/gmp --libdir=/usr/lib
  make -j8&&make install

  cd /home/mpc-0.8.1
  ./configure --prefix=/usr/local/mpc -with-mpfr=/usr/local/mpfr -with-gmp=/usr/local/gmp --libdir=/usr/lib
  make -j8&&make install

  cd /home/gcc-4.6.1
  ./configure --prefix=/usr/local/gcc --enable-threads=posix --disable-checking --disable-multilib --enable-languages=c,c++ --with-gmp=/usr/local/gmp --with-mpfr=/usr/local/mpfr/ --with-mpc=/usr/local/mpc/
  export LD_LIBRARY_PATH=/usr/lib
  make -j8&& make install

  mkdir -p /usr/bin/backup/
  mv /usr/bin/{gcc,g++} /usr/bin/backup/

  ln -s /usr/local/gcc/bin/gcc /usr/bin/gcc
  ln -s /usr/local/gcc/bin/g++ /usr/bin/g++

  gcc --version
  g++ --version

  注意编译安装完成后需配置环境变量，先在文件“/etc/ld.so.conf”中添加保存如下内容，然后执行命令“ldconfig”使其生效：

        include ld.so.conf.d/*.conf
        /usr/lib
        /usr/local/gmp/lib
        /usr/local/mpfr/lib
        /usr/local/mpc/lib
        /usr/local/gcc/lib

5. 安装protobuf-c

export PKG_CONFIG_PATH=/usr/lib/pkgconfig/

cd /home
git clone https://github.com/protobuf-c/protobuf-c
cd protobuf-c
./configure --prefix=/usr/local/protobuf-c --libdir=/usr/lib
make -j8&&make install

6. 安装libevent

  cd /home
  git clone https://github.com/libevent/libevent
  cd libevent/
  ./autogen.sh 
  ./configure --prefix=/usr/local/libevent --libdir=/usr/lib
  make -j8&&make install

7. 安装fstrm

  export PKG_CONFIG_PATH=/usr/lib/pkgconfig
  export LD_LIBRARY_PATH=/usr/lib
  echo $PKG_CONFIG_PATH
  echo $LD_LIBRARY_PATH

  cd /home
  git clone https://github.com/farsightsec/fstrm
  cd fstrm/
  ./autogen.sh 
  ./configure --prefix=/usr/local/fstrm --libdir=/usr/lib
  make -j8&&make install

  ln -s /usr/local/fstrm/bin/fstrm_capture /usr/bin
    ```
8. 编译BIND

     在BIND源文件目下执行“./configure”进行编译时需要添加dnstap有关的参数。
```shell
  ./configure '--enable-dnstap' '--with-libfstrm=/usr/local/fstrm/' '--with-protobuf-c=/usr/local/protobuf-c/'

9. 配置BIND

   在BIND配置文件的options区块中添加dnstap参数。

options {
  dnstap {client response;};
  dnstap-output unix "/usr/local/named/var/run/dnstap.sock";
  dnstap-version none;
};

10. 后台运行fstrm_capture

mkdir -p /home/data/dnstap/

(fstrm_capture -t protobuf:dnstap.Dnstap -u /usr/local/named/var/run/dnstap.sock -w /home/data/dnstap/%Y%m%d%H%M --split 60 --localtime &)

ps -ef | grep fstrm_capture

11. 启动或重载BIND，实现进程数据传递

12. 解读dnstap日志

使用BIND安装目录bin文件夹下的“dnstap-read”。

13. 用awk批量处理解读日志的A记录

/usr/local/named/bin/dnstap-read -mp $dnstap.log > $dnsread.log

awk -v DAY="$DAY" 'BEGIN{RS=DAY;ORS=" "}{gsub(":"," ",$3);gsub(",","",$14);gsub(";","",$33);print DAY,$1,$2,$3,$33,$34,$35,$14;if($14~/NOERROR/){if($42~/CNAME/){}else{print $33};for (i=39;i<=NF;i++){if($(i-1)~/CNAME/&&$(i+4)~/^A$/){print $i}else if($(i-1)~/^A$/){print $i;break}}};printf "\n"}' $dnsread.log >> $dns.log

awk的层次分解如下：

awk -v DAY="$DAY" 'BEGIN{RS=DAY;ORS=" "}{
  gsub(":"," ",$3);
  gsub(",","",$14);
  gsub(";","",$33);
  print DAY,$1,$2,$3,$33,$34,$35,$14;
  if($14~/NOERROR/)
  {
    if($42~/CNAME/){}else{print $33};
    for (i=39;i<=NF;i++)
    {
      if($(i-1)~/CNAME/&&$(i+4)~/^A$/)
      {
        print $i
      }
      else if($(i-1)~/^A$/)
      {
        print $i;break
      }
    }
  };
  printf "\n"
}' $dnsread >> $dnslog