# Infoblox NIOS DNS Logs via NetoDNS syslog

Netography Fusion ingests Infoblox NIOS DNS logs via `netodns`, a software component from Netography that you deploy and operates as a syslog listener in your local environment. You configure Infoblox NIOS to send query logs via syslog to this component, which then utilizes the Netography Fusion API to deliver the logs securely to Fusion.

### Step 1. Deploy NetoDNS

First, you must deploy `netodns` to a system in your environment. If you have deployed the NetoFlow Collector, deployment and configuration follow similar steps.

* `netodns` listens on TCP port 514 (syslog), and needs network access to allow an inbound connection to this port from your Infoblox NIOS system that will be sending syslog output.
* You should restrict network access to `netodns` to only the Infoblox NIOS IP(s) to prevent other systems from also sending syslog to this device.

### Step 2. Infoblox NIOS Configuration

> ℹ️ Impact of enabling query logging on Infoblox NIOS
>
> Enabling `queries` and `responses` logging in Infoblox will have some impact on NIOS system performance, the extent to which is highly dependent on your configuration, system specs, and volume.
>
> If you have a large Infoblox Grid deployment, it is recommended you incrementally enable syslog on members of the grid and monitor the Infoblox system utilization to ensure it has adequate system resources with this additional logging enabled.
>
> If you have scaling issues deploying this configuration, contact Netography Support to discuss. Netography chose syslog as the most real-time and compatible method for log ingest across Infoblox NIOS deployments/versions, but there are alternative methods that may be supported in the future by Fusion.

Configure Infoblox NIOS to send `queries` and `responses` via syslog (TCP/514) to `netodns`. Consult Infoblox documentation for your specific product and version for the updated configuration steps for doing so.

See: <https://docs.infoblox.com/space/nios90/280403148/Using+a+Syslog+Server>

#### Configuring Syslog in Infoblox NIOS

To configure a NIOS appliance to send syslog to `netodns`, complete the following:

1. From the **Grid** tab, select the \*\*Grid Manager \*\*tab -> **Members** tab, and then click \*\*Grid Properties \*\*-> \*\*Edit \*\*from the Toolbar.
2. In the *Grid Properties* editor, select the\*\* Monitoring\*\* tab, and then configure syslog output, using the following settings.

| Setting                        | Value                                             |
| ------------------------------ | ------------------------------------------------- |
| Log to External Syslog Servers | Enabled                                           |
| Address                        | IP/FQDN of `netodns` deployed in your environment |
| Transport                      | TCP                                               |
| Source                         | Any                                               |
| Node ID                        | LAN                                               |
| Port                           | 514                                               |
| Severity                       | Info                                              |
| Logging Category               | DNS Logging Categories:`queries` `responses`      |

### Netography Fusion Setup

Once `netodns` receives syslog from Infoblox NIOS, it will add a traffic source for Infoblox NIOS to Fusion and you will see DNS traffic in the Fusion Portal. No configuration is required in the Fusion portal.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/ingest-network-traffic-logs/dns-logs/infoblox-nios-dns-logs-via-netodns-syslog.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.