01. 03. 2023 Tobias Goller NetEye

Enable DNS Caching on RedHat 8

I was recently with a customer when he pointed out to me that his NetEye 4 system with its RedHat 8 operating system was sending an extremely large number of DNS queries to the DNS servers.

After quickly analyzing the situation I found that RHEL does not cache DNS queries by default. Obviously the customer wanted caching on NetEye’s RHEL.

So I started to read up on the topic and found several options in the RedHat documentation that can be used to enable DNS caching in RHEL systems: DNSMASQ, NSCD, UNBOUND, and systemd-resolved.

I’ll now briefly describe these four ways according to the RedHat documentation.

Using DNSMASQ
If you use DNSMASQ you’ll have to install the dnsmasq package on the system, then configure /etc/dnsmasq.conf so that it points to localhost as the name server in /etc/resolv.conf. Finally, add the dnsmasq service to the runlevel.

Another way would be to add dnsmasq to NetworkManager.

Using NSCD
Here you’ll need to install the nscd package. Once it’s installed you can use the nscd -g command to check if caching is enabled.

Using UNBOUND
First the UNBOUND package must be installed on the system. By using UNBOUND caching, the system can obtain the DNS cache from other systems or provide it to other systems (this can be configured according to your requirements). Once the configuration is complete, it can be checked for errors using the unbound-checkconf command. Finally, make sure the service is started and configured to start on boot.

systemd-resolved
Note: systemd-resolved is provided as a Technology Preview in RHEL 8 and 9.

As described in the RedHat documentation, systemd-resolved.service is disabled by default, but comes with the default installation. The systemd-resolved.service is available in RHEL 8 and is provided by the systemd package itself.

You can configure systemd-resolved.service in the file /etc/systemd/resolved.conf, or point directly from /etc/resolv.conf to the local DNS systemd-resolved.service. Finally, make sure the service is started and configured to start on boot.

Now that I’ve explained the four options, I’d like to present my solution which I selected for a NetEye 4 system with RedHat 8.

I chose the fourth variant, the one with the systemd-resolved.service. All I needed to do was adjust the /etc/resolv.conf file and start systemd-resolved.service. In the first line of /etc/resolv.conf I specified the local name server with the IP 127.0.0.53, which points to systemd-resolved.service.

Here is my /etc/resolv.conf file as an example:

$ cat /etc/resolv.conf
name server 127.0.0.53
name server 192.168.1.1
name server 192.168.1.2
search wuerth-phoenix.com

Have fun trying.

These Solutions are Engineered by Humans

Did you find this article interesting? Does it match your skill set? Our customers often present us with problems that need customized solutions. In fact, we’re currently hiring for roles just like this and others here at Würth Phoenix.

Tobias Goller

NetEye Solution Architect at Würth Phoenix

I started my professional career as a system administrator. Over the years, my area of responsibility changed from administrative work to the architectural planning of systems. During my activities at Würth Phoenix, the focus of my area of responsibility changed to the installation and consulting of the IT system management solution WÜRTHPHOENIX NetEye. In the meantime, I take care of the implementation and planning of customer projects in the area of our unified monitoring solution.

Author

Tobias Goller

Latest posts by Tobias Goller

25. 10. 2024 Log-SIEM

Enhancing Cybersecurity with Elastic Defend: A Technical Consultant’s Perspective

28. 08. 2024 Unified Monitoring

ntopng Updates

08. 07. 2024 Unified Monitoring

Collecting Netflows – ntopng vs. ElastiFlow

06. 05. 2024 Unified Monitoring

QUIC, What’s That?

05. 03. 2024 Unified Monitoring

nBox Mini

See All