Maintained by: NLnet Labs

Query logging performance

Darren Spruell
Mon Aug 3 19:50:39 CEST 2015

Unbound's documentation mentions that query logging can have very
adverse performance on server operation. I was curious if the project
feels this has been optimized to the degree possible already, or if an
approach similar to what some other projects take may be beneficial;
namely something like delegating logging responsibilities to a
different thread (Suricata IDS engine, I think) or even using a
separate log output process (Squid [1], OpenBSD's PF/pflogd(8) [2]).

Alternately, is dnstap [3] the preferred direction for this? Depending
on the implementation, the difference in complexity between a fast,
native textual query log on the server vs. a dnstap configuration
could be a factor.


Darren Spruell
phatbuckett at