Overview
The ElastiFlow Unified Flow Collector can be configured to resolve IP addresses to hostnames. The following settings allow this feature to be tuned to the needs of your environment.
EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE
This setting enables DNS reverse lookups of IP addresses found in the received flow records.
Valid Values
true,false
Default
false
EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_IP
The default behavior of the collector is to use the operating system's configured name resolution to resolve IP addresses to hostnames. Optionally a nameserver can be specified in this setting, which will be used instead.
:::info If configured, this setting MUST contain a valid IP address. :::
Default
empty
EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_TIMEOUT
If EF_PROCESSOR_ENRICH_IPADDR_DNS_NAMESERVER_IP contains a valid IP address, this setting contains the timeout period, in milliseconds, for queries to the name server.
Default
3000(milliseconds)
EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PRIVATE
If DNS resolution is enabled (EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE is true) this option specifies whether private IP addresses will be resolved to hostnames.
Valid Values
true,false
Default
true
EF_PROCESSOR_ENRICH_IPADDR_DNS_RESOLVE_PUBLIC
If DNS resolution is enabled (EF_PROCESSOR_ENRICH_IPADDR_DNS_ENABLE is true) this option specifies whether public IP addresses will be resolved to hostnames.
Valid Values
true,false
Default
true
EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH
This setting specifies the path to the file containing user-defined hostname mappings. The feature is enabled if a path is configured, otherwise it is disabled.
An example of the format of this file is:
Default
''
Recommended
/etc/elastiflow/hostname/user_defined.yml
EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_REFRESH_RATE
The file specified in EF_PROCESSOR_ENRICH_IPADDR_DNS_USERDEF_PATH can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of 0 disables refreshing of the values.
Default
15
EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_PATH
For more control of when enrichment is applied, IP addresses can be included or excluded from hostname enrichment by Autonomous System or CIDR. This setting specifies the path to this file.
For more details on the format of this file and the behavior of the include/exclude functionality refer to: Scoping Enrichment with Include/Exclude
Default
''
Recommended
/etc/elastiflow/hostname/incl_excl.yml
EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_REFRESH_RATE
The file specified in EF_PROCESSOR_ENRICH_IPADDR_DNS_INCLEXCL_PATH can be loaded automatically to refresh values without restarting the collector. This value specifies the refresh interval, in minutes, that the file will be reloaded. The value of 0 disables refreshing of the values.
Default
15