Enabling DNS collection

Gremlin can collect information about the DNS queries on the Linux machines where the Gremlin Agent is installed. This helps Gremlin identify dependencies belonging to your services.

‍

What is collected?

For every DNS query visible to the Gremlin Agent, Gremlin will collect:

• container ID
• hostname in query
• returned aliases from query
• returned ip addresses from query

‍

Requirements

Using this feature requires the following:

• Gremlin Agent version 2.40.1 or later
• Gremlin Kubernetes Chao version 0.3+
• The agent running within the PID namespace of the host; for Kubernetes this means setting hostPID=true
• The CAP_NET_RAW capability enabled for the agent

DNS collection is experimental for Windows. Installation of WinPcap, Npcap, or Win10Pcap is required.

‍

Enable DNS Collection

DNS collection is enabled by default as of agent version 2.42.0. If you previously disabled it and want to re-enable it, either:

• Set the GREMLIN_COLLECT_DNS environment variable to true (e.g. by adding GREMLIN_COLLECT_DNS=true to /etc/default/gremlind)
• Set collect_dns: true in your Gremlin config file (e.g. /etc/gremlin/config.yaml)

‍

Disable DNS Collection

To disable DNS collection, either:

• Set the GREMLIN_COLLECT_DNS environment variable to false (e.g. by adding GREMLIN_COLLECT_DNS=false to /etc/default/gremlind)
• Set collect_dns: false in your Gremlin config file (e.g. /etc/gremlin/config.yaml)

After changing either setting, restart the agent. The installer doesn't create /etc/default/gremlind; if the file doesn't exist yet, create it or copy /etc/default/gremlind.example.

‍