You can configure the BIG-IP® system to log information about DNS denial-of-service (DoS) events and send the log messages to remote IPFIX collectors.
IPFIX is a set of IETF standards. The BIG-IP system supports logging of DNS DoS events over the IPFIX protocol. IPFIX logs are raw, binary-encoded strings with their fields and field lengths defined by IPFIX templates. IPFIX collectors are external devices that can receive IPFIX templates and use them to interpret IPFIX logs.
The configuration process involves creating and connecting the following configuration objects:
|Pool of IPFIX collectors||Create a pool of IPFIX collectors to which the BIG-IP system can send IPFIX log messages.|
|Destination||Create a log destination to format the logs in IPFIX templates, and forward the logs to the IPFIX collectors.|
|Publisher||Create a log publisher to send logs to a set of specified log destinations.|
A log destination of the IPFIX type specifies that log messages are sent to a pool of IPFIX collectors. Use these steps to create a log destination for IPFIX collectors.
The log destination periodically retransmits all of its IPFIX templates over a UDP connection. The retransmissions are helpful for UDP connections, which are lossy.
Now you have an implementation in which the BIG-IP® system logs messages about DNS DoS events and sends the log messages to a pool of IPFIX collectors.