RPZ Log Format

I was wondering about the contents of RPZ logs. The last field contains the
“rule” that was triggered, i.e. the entry in the zone that was matched.
When the owner name that was matched in the RPZ is a wildcard, that last
field shows the expanded QNAME that was matched and not the actual wildcard
entry in the zone.

Is that behavior a deliberate choice? It makes it a little more difficult
to find the real entry in the zone that was matched. For example, we want
to generate statics on how many “hits” are associated with a given object
we’re blocking. We’ve got to have a copy of the RPZ and implement some
logic to “undo” the wildcard matches to figure it out. Whereas if that
field in the RPZ was the real, unexpanded owner name in the zone, we could
just add it up with trivial logic and no knowledge of the RPZ content.

Maybe the ship has sailed on the default format, but is there any
particular challenge in making a switch to flip on this other behavior?

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.