---
title: "ddi.infoblox"
canonical: "https://docs.devo.com/space/latest/94661968/ddi.infoblox"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `ddi.infoblox` identify events generated by [Infoblox](https://docs.infoblox.com/display/nios85).

## Valid tags and data tables

<span style="color: #282828">The full tag must have </span><span style="color: #000000">4</span><span style="color: #282828"> levels. The first two are fixed as</span><span style="color: #000000">** **</span>`ddi.infoblox`<span style="color: #282828">. The third level identifies the type of events sent, and the fourth level indicates the event subtype. </span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Infoblox solutions | - `ddi.infoblox.audit.httpd`
- `ddi.infoblox.dns.dtc`
- `ddi.infoblox.audit.serial_console`
- `ddi.infoblox.dns.config`
- `ddi.infoblox.dns.resolver`
- `ddi.infoblox.dns.database`
- `ddi.infoblox.dns.queries`
- `ddi.infoblox.dns.infoblox-responses`
- `ddi.infoblox.dns.query-errors`
- `ddi.infoblox.unknown.unknown` | `ddi.infoblox` |
| - `ddi.infoblox.audit.httpd`
- `ddi.infoblox.audit.serial_console`
- `ddi.infoblox.audit.sshd` | `ddi.infoblox.audit` |
| `ddi.infoblox.audit.httpd` | `ddi.infoblox.audit.httpd` |
| `ddi.infoblox.audit.serial_console` | `ddi.infoblox.audit.serial_console` |
| `ddi.infoblox.audit.sshd` | `ddi.infoblox.audit.sshd` |
| `ddi.infoblox.dhcp.validate_dhcpd` | `ddi.infoblox.dhcp` |
| `ddi.infoblox.dhcp.dhcpd` | `ddi.infoblox.dhcp.dhcpd` |
| `ddi.infoblox.dhcp.validate_dhcpd` | `ddi.infoblox.dhcp.validate_dhcpd` |
| - `ddi.infoblox.dns.dtc`
- `ddi.infoblox.dns.config`
- `ddi.infoblox.dns.database`
- `ddi.infoblox.dns.resolver`
- `ddi.infoblox.dns.query-errors`
- `ddi.infoblox.dns.queries`
- `ddi.infoblox.dns.infoblox-responses` | `ddi.infoblox.dns` |
| `ddi.infoblox.dns.client` | `ddi.infoblox.dns.client` |
| `ddi.infoblox.dns.config` | `ddi.infoblox.dns.config` |
| `ddi.infoblox.dns.database` | `ddi.infoblox.dns.database` |
| `ddi.infoblox.dns.dtc` | `ddi.infoblox.dns.dtc` |
| `ddi.infoblox.dns.general` | `ddi.infoblox.dns.general` |
| `ddi.infoblox.dns.infoblox-responses` | `ddi.infoblox.dns.infobloxResponses` |
| `ddi.infoblox.dns.lame-servers` | `ddi.infoblox.dns.lameServers` |
| `ddi.infoblox.dns.network` | `ddi.infoblox.dns.network` |
| `ddi.infoblox.dns.notify` | `ddi.infoblox.dns.notify` |
| `ddi.infoblox.dns.queries` | `ddi.infoblox.dns.queries` |
| `ddi.infoblox.dns.queries_responses` | `ddi.infoblox.dns.queries_responses`<br>> ⚠️ **Union table**
> ⚠️ 
> ⚠️ This is a union table that collects events from a set of tables for easy access and analysis.
> ⚠️ 
> ⚠️ Learn more about this union table [in this article](/wiki/spaces/latest/pages/181403724). |
| `ddi.infoblox.dns.queryErrors` | `ddi.infoblox.dns.queryErrors` |
| `ddi.infoblox.dns.rate-limit` | `ddi.infoblox.dns.rateLimit` |
| `ddi.infoblox.dns.resolver` | `ddi.infoblox.dns.resolver` |
| `ddi.infoblox.dns.rpz` | `ddi.infoblox.dns.rpz` |
| `ddi.infoblox.dns.security` | `ddi.infoblox.dns.security` |
| `ddi.infoblox.dns.unknown` | `ddi.infoblox.dns.unknown` |
| `ddi.infoblox.dns.update` | `ddi.infoblox.dns.update` |
| `ddi.infoblox.dns.update-security` | `ddi.infoblox.dns.updateSecurity` |
| `ddi.infoblox.dns.xfer-in` | `ddi.infoblox.dns.xferIn` |
| `ddi.infoblox.dns.xfer-out` | `ddi.infoblox.dns.xferOut` |
| - `ddi.infoblox.nios.monitor`
- `ddi.infoblox.nios.ntpd`
- `ddi.infoblox.nios.rabbitmq_control`
- `ddi.infoblox.nios.syslog-ng`
- `ddi.infoblox.nios.update` | `ddi.infoblox.nios` |
| `ddi.infoblox.nios.monitor` | `ddi.infoblox.nios.monitor` |
| `ddi.infoblox.nios.ntpd` | `ddi.infoblox.nios.ntpd` |
| `ddi.infoblox.nios.ntpdate` | `ddi.infoblox.nios.ntpdate` |
| `ddi.infoblox.nios.rabbitmq_control` | `ddi.infoblox.nios.rabbitmq_control` |
| `ddi.infoblox.nios.syslog-ng` | `ddi.infoblox.nios.syslogNg` |
| `ddi.infoblox.unknown.unknown` | `ddi.infoblox.unknown.unknown` |

## <span style="color: #282828">How is the data sent to Devo?</span>

### **Set up the Devo relay rules**

You will need to set up a rule on the relay to correctly process and forward the events received from Infoblox. In the example below, you should use any port that you can dedicate to these events.

![image](media://672abbf7-9201-4468-8560-aa1bfc783fb6)

### Infoblox - DNS Categories

Infoblox classifies the DNS logs in different categories. You can know more about this in their documentation: [Setting DNS Logging Categories](https://docs.infoblox.com/display/NAG8/Using+a+Syslog+Server#UsingaSyslogServer-SettingDNSLoggingCategoriesbookmark2792bookmark2793SettingDNSLoggingCategoriebookmark2794s). The table below depicts which Devo Relay rule would process each DNS Logging Category.

| **Infoblox DNS Logging Categories** | **Relay rule names** |
| --- | --- |
| **DDI Infoblox - DNS Categories** | **DDI Infoblox - DNS Category DTC 1** | **DDI Infoblox - DNS Category DTC 2** | **DDI Infoblox - unknown DNS Categories** |
| general | <span style="color: #4d5156">**✓**</span> |  |  |  |
| client | <span style="color: #4d5156">**✓**</span> |  |  |  |
| config | <span style="color: #4d5156">**✓**</span> |  |  |  |
| database | <span style="color: #4d5156">**✓**</span> |  |  |  |
| dnssec |  |  |  | <span style="color: #4d5156">**✓**</span> |
| lame servers | <span style="color: #4d5156">**✓**</span> |  |  |  |
| network | <span style="color: #4d5156">**✓**</span> |  |  |  |
| notify | <span style="color: #4d5156">**✓**</span> |  |  |  |
| queries | <span style="color: #4d5156">**✓**</span> |  |  |  |
| rate-limit | <span style="color: #4d5156">**✓**</span> |  |  |  |
| resolver | <span style="color: #4d5156">**✓**</span> |  |  |  |
| responses | <span style="color: #4d5156">**✓**</span> |  |  |  |
| rpz | <span style="color: #4d5156">**✓**</span> |  |  |  |
| security | <span style="color: #4d5156">**✓**</span> |  |  |  |
| transfer-in | <span style="color: #4d5156">**✓**</span> |  |  |  |
| transfer-out | <span style="color: #4d5156">**✓**</span> |  |  |  |
| update | <span style="color: #4d5156">**✓**</span> |  |  |  |
| update-security | <span style="color: #4d5156">**✓**</span> |  |  |  |
| DTC load balancing |  |  | <span style="color: #4d5156">**✓**</span> |  |
| DTC health monitors |  | <span style="color: #4d5156">**✓**</span> |  |  |

| **Rules** |
| --- |
| ### DDI Infoblox - DNS Categories<br>- Source Port → Customer source port, for example `13004`
- Source data → ^.**named\[\d*\*]:\s+([\S]+):
- Target Tag → `ddi.infoblox.dns.\\d1`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |
| ### DDI Infoblox - DNS Category DTC 2<br>- Source Port → Customer source port, for example `13004`
- Source data → `^named\[\d*\]:\s+request\s`
- Target Tag → `ddi.infoblox.dns.dtc`
- Sent without syslog tag → `True`
- Is Prefix →`False` (by default)
- Stop processing → `True` |
| ### DDI Infoblox - unknown DNS Categories<br>- Source Port → Customer source port, for example `13004`
- Source data → `^(?:import_)?named\[\d*\]`
- Target Tag → `ddi.infoblox.dns.unknown`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |
| ### DDI Infoblox - DNS Category DTC 1<br>- Source Port → Customer source port, for example `13004`
- Source data → `^idns_health`
- Target Tag → `ddi.infoblox.dns.dtc`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |

###   
Infoblox - DHCP

| **Rules** |
| --- |
| ### DDI Infoblox - DHCP<br>- Source Port → Customer source port, for example `13004`
- Source data → `^.*(validate_dhcpd|dhcpd)`
- Target Tag → `ddi.infoblox.dhcp.\\d1`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |

### Infoblox - NIOS

| **Rules** |
| --- |
| ### DDI Infoblox - NIOS<br>- Source Port → Customer source port, for example `13004`
- Source data → `^(ntpdate|monitor|ntpd|rabbitmq_control|syslog-ng)`
- Target Tag → `ddi.infoblox.nios.\\d1`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |

### Infoblox - Audit

| **Rules** |
| --- |
| ### DDI Infoblox - AUDIT<br>- Source Port → Customer source port, for example `13004`
- Source data → `^.*(serial_console|httpd|sshd)`
- Target Tag → `ddi.infoblox.audit.\\d1`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |

### Infoblox - unknown

| **Rules** |
| --- |
| ### DDI Infoblox - unknown<br>- Source Port → Customer source port, for example `13004`
- Target Tag → `ddi.infoblox.unknown.unknown`
- Sent without syslog tag → `True`
- Is Prefix → `False` (by default)
- Stop processing → `True` |

## Configure Infoblox NIOS to send logs to the Relay

Before starting the configuration, please read the [Infoblox documentation](https://docs.infoblox.com/display/NAG8/Using+a+Syslog+Server).

### Setting DNS Logging Categories

Infoblox DNS logs have different categories. You can select which categories you would like to send into Devo by following these steps:

1. Select Data Management tab
2. Select the DNS tab
3. Click Grid DNS Properties from the Toolbar
4. Enable de Advanced Mode by clicking on “Toggle Expert Mode” if the editor is in the basic mode.
5. Select the Logging tab
6. Select the Logging Categories you would like to send to Devo.
7. Save & Close

> ⚠️ <span style="color: #5c5c5c">Enabling some logging categories can increase disk space usage and adversely affect DNS services and performance. Check with Infoblox whether you are recommended to logging some of these categories.</span>

![image](media://8a87223a-724e-4a6c-9e09-cae7d5c34e48)

After saving the changes, you may be prompted to restart the DNS service for the changes to take effect.

### Specifying Syslog Servers

Follow the next steps to configure your **Infoblox** to send messages to the Devo Relay:

1. Select the Grid tab
2. Select the Grid Manager tab
3. Select the Members tab
4. Click Grid Properties from the Toolbar.
5. In the Grid Properties editor, select the Monitoring tab. You will see a window like this below.  
  
> Macro (inline-media-image)
6. Select “Log to External Syslog Servers” to enable the Infoblox appliance to send messages to a specified Syslog server.
7. Select also the “Copy Audit Log Message to Syslog” so you will be able to send audit logs to Devo.
8. To define a new Devo Relay, click the Add icon and complete the following fields:
  - Address: Devo Relay IP address
  - Transport: Secure TCP, TCP or UDP. If selecting Secure TCP, you will need to configure Stunnel in front of the Devo Relay so Stunnel will decrypt the logs and send them decrypted to the Devo Relay. [Here](https://docs.devo.com/confluence/ndt/v7.9.0/sending-data-to-devo/devo-relay/configuring-devo-relay/configuring-devo-relay-on-the-linux-command-line/sending-ssl-tls-encrypted-events-to-the-relay) you can read more about integrating Stunnel with the Devo Relay.
  - Interface: at your convenience.
  - Node ID: at your convenience.
  - Source: at your convenience.
  - Severity: at your convenience.
  - Port: Devo Relay port or Stunnel port listening for logs. If using the Infoblox option Transport TCP or UDP you must use the Source port of the relay rules you configured previously. If you selected Secure TCP, then you must enter the Stunnel listening port.
  - Logging category: you must select the option “Send selected categories” and then move to the “Selected” space all the categories you want to send to Devo. The reason for selecting the option “Send selected categories” instead of the option “Send all” is that logs will be prefixed and the Devo parsing will only work for prefixed logs of Infoblox. Read more about Infoblox log prefixes [here](https://docs.infoblox.com/display/NAG8/Using+a+Syslog+Server#:~:text=one%20logging%20category.-,The%20syslog%20messages%20are%20prefixed%20with%20a%20category%20name%20to%20which%20it%20belongs,-.%20Also%2C%20the%20RPZ).
  - Then click on the Add button and you will see the configured Devo Relay as part of the list of Syslog Servers.
  - Save & Close

After saving the changes, you may be required to do a service restart for the changes to take effect. Your Infoblox appliance will start to send Syslog to your Devo Relay.

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [ddi.infoblox](#tag1)
> - [ddi.infoblox.audit](#tag2)
> - [ddi.infoblox.audit.httpd](#tag3)
> - [ddi.infoblox.audit.serial-console](#tag4)
> - [ddi.infoblox.audit.sshd](#tag5)
> - [ddi.infoblox.dhcp](#tag6)
> 
> ### > Macro (anchor)
> 
> ddi.infoblox
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *type* | `str` | *vtype* |  |
> | *subtype* | `str` | *vsubtype* |  |
> | *hostname* | `str` |  |  |
> | *server* | `str` |  |  |
> | *pid* | `int4` |  |  |
> | *message* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.audit
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *subtype* | `str` | *vsubtype* |  |
> | *server* | `str` |  |  |
> | *pid* | `int4` |  |  |
> | *serverdate* | `timestamp` |  |  |
> | *admin_user* | `str` |  |  |
> | *action* | `str` |  |  |
> | *object_type* | `str` |  |  |
> | *object_name* | `str` |  |  |
> | *message* | `str` |  |  |
> | *srcIp* | `ip4` |  |  |
> | *to* | `str` |  |  |
> | *auth* | `str` |  |  |
> | *admin_group* | `str` |  |  |
> | *apparently_via* | `str` |  |  |
> | *info* | `str` |  |  |
> | *trigger_event* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.audit.httpd
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *serverdate* | `timestamp` |  |
> | *admin_user* | `str` |  |
> | *action* | `str` |  |
> | *object_type* | `str` |  |
> | *object_name* | `str` |  |
> | *message* | `str` |  |
> | *srcIp* | `ip4` |  |
> | *to* | `str` |  |
> | *auth* | `str` |  |
> | *admin_group* | `str` |  |
> | *apparently_via* | `str` |  |
> | *info* | `str` |  |
> | *trigger_event* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.audit.serial_console
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | eventdate | `timestamp` |  |
> | hostname | `str` |  |
> | server | `str` |  |
> | serverdate | `timestamp` |  |
> | admin_user | `str` |  |
> | action | `str` |  |
> | object_type | `str` |  |
> | object_name | `str` |  |
> | message | `str` |  |
> | srcIp | `ip4` |  |
> | to | `str` |  |
> | auth | `str` |  |
> | admin_group | `str` |  |
> | apparently_via | `str` |  |
> | info | `str` |  |
> | trigger_event | `str` |  |
> | hostchain | `str` | **✓** |
> | tag | `str` | **✓** |
> | rawMessage | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.audit.sshd
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dhcp
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *subtype* | `str` | *vsubtype* |  |
> | *server* | `str` |  |  |
> | *pid* | `int4` |  |  |
> | *message* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [ddi.infoblox.dhcp.dhcpd](#tag7)
> - [ddi.infoblox.dhcp.validate_dhcpd](#tag8)
> - [ddi.infoblox.dns](#tag9)
> - [ddi.infoblox.dns.client](#tag10)
> - [ddi.infoblox.dns.config](#tag11)
> - [ddi.infoblox.dns.database](#tag12)
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dhcp.dhcpd
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *server* | `str` |  |  |  |
> | *pid* | `int4` |  |  |  |
> | *message_type* | `str` |  |  |  |
> | *toAddress* | `str` |  |  |  |
> | *toDeviceId* | `str` |  |  |  |
> | *fromAddress* | `str` |  |  |  |
> | *fromDeviceId* | `str` |  |  |  |
> | *ofAddress* | `str` |  |  |  |
> | *ofDeviceId* | `str` |  |  |  |
> | *onAddress* | `str` |  |  |  |
> | *onDeviceId* | `str` |  |  |  |
> | *forAddress* | `str` |  |  |  |
> | *forDeviceId* | `str` |  |  |  |
> | *via* | `str` |  |  |  |
> | *viaDeviceId* | `str` |  |  |  |
> | *TransID* | `str` |  |  |  |
> | *network* | `str` |  |  |  |
> | *uid* | `str` |  |  |  |
> | *message* | `str` |  |  |  |
> | *leaseIpAddress* | `str` | ```
> ifthenelse(message_type in set(["DHCPACK", "DHCPOFFER", "BOOTREPLY", "DHCPEXPIRE", "RELEASE"]), ifthenelse(isnull(onAddress), toAddress, onAddress), null)
> ``` | *onAddress*<br>*toAddress*<br>*message_type* |  |
> | *leaseHardwareAddress* | `str` | ```
> ifthenelse(message_type in set(["DHCPACK", "DHCPOFFER", "BOOTREPLY", "DHCPEXPIRE", "RELEASE"]), ifthenelse(isnull(onAddress), toDeviceId, toAddress), null)
> ``` | *toDeviceId*<br>*onAddress*<br>*toAddress*<br>*message_type* |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dhcp.validate_dhcpd
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *subtype* | `str` | *vsubtype* |  |
> | *hostname* | `str` |  |  |
> | *server* | `str` |  |  |
> | *pid* | `int4` |  |  |
> | *ib_category* | `str` |  |  |
> | *message* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.client
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *action* | `str` |  |
> | *name_blacklist* | `str` |  |
> | *query_name* | `str` |  |
> | *client_ip* | `ip4` |  |
> | *client_object* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *dns_view* | `str` |  |
> | *info* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.config
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.database
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [ddi.infoblox.dns.dtc](#tag13)
> - [ddi.infoblox.dns.general](#tag14)
> - [ddi.infoblox.dns.infobloxResponses](#tag15)
> - [ddi.infoblox.dns.lameServers](#tag16)
> - [ddi.infoblox.dns.network](#tag17)
> - [ddi.infoblox.dns.notify](#tag18)
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.dtc
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.general
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *quota_used* | `int8` |  |
> | *quota_max* | `int8` |  |
> | *quota_soft_limits* | `int8` |  |
> | *quota_s_over* | `int8` |  |
> | *quota_hard_limit* | `int8` |  |
> | *quota_h_over* | `int8` |  |
> | *quota_low_pri* | `int8` |  |
> | *dns_view* | `str` |  |
> | *dns_view_size* | `int8` |  |
> | *dns_view_hits* | `int8` |  |
> | *dns_view_misses* | `int8` |  |
> | *zone_name* | `str` |  |
> | *zone_message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.infobloxResponses
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *serverdate* | `timestamp` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *query_name* | `str` |  |
> | *dns_view* | `str` |  |
> | *protocol* | `str` |  |
> | *class* | `str` |  |
> | *type* | `str` |  |
> | *response_info* | `str` |  |
> | *rcode* | `str` |  |
> | *flags* | `str` |  |
> | *recursion* | `bool` |  |
> | *authoritative_answer* | `bool` |  |
> | *truncated_response* | `bool` |  |
> | *edns_opt_record* | `bool` |  |
> | *dnssec* | `bool` |  |
> | *dnssec_records_validated* | `bool` |  |
> | *dtc_synthetic_record* | `bool` |  |
> | *rr_text* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.lameServers
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | eventdate | `timestamp` |  |
> | hostname | `str` |  |
> | server | `str` |  |
> | pid | `int4` |  |
> | ib_category | `str` |  |
> | message | `str` |  |
> | action | `str` |  |
> | query_name | `str` |  |
> | type | `str` |  |
> | class | `str` |  |
> | client_ip | `ip4` |  |
> | port | `int4` |  |
> | hostchain | `str` | **✓** |
> | tag | `str` | **✓** |
> | rawMessage | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.network
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_ip* | `ip4` |  |
> | *port* | `int4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.notify
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *zone* | `str` |  |
> | *class* | `str` |  |
> | *info* | `str` |  |
> | *serial* | `int8` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `ip4` |  |
> | *port* | `int4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [ddi.infoblox.dns.queries](#tag19)
> - [ddi.infoblox.dns.queryErrors](#tag20)
> - [ddi.infoblox.dns.rateLimit](#tag21)
> - [ddi.infoblox.dns.resolver](#tag22)
> - [ddi.infoblox.dns.rpz](#tag23)
> - [ddi.infoblox.dns.security](#tag24)
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.queries
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *query_name* | `str` |  |
> | *dns_view* | `str` |  |
> | *query* | `str` |  |
> | *class* | `str` |  |
> | *type* | `str` |  |
> | *flags* | `str` |  |
> | *recursion_desired* | `bool` |  |
> | *query_signed* | `bool` |  |
> | *edns* | `bool` |  |
> | *edns_version* | `int4` |  |
> | *tcp* | `bool` |  |
> | *dnssec* | `bool` |  |
> | *checking_disabled* | `bool` |  |
> | *valid_dns_server_cookie_rcv* | `bool` |  |
> | *dns_cookie_without_valid_server_cookie* | `bool` |  |
> | *dnsServer* | `ip4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.queryErrors
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *query_name* | `str` |  |
> | *dns_view* | `str` |  |
> | *info_error* | `str` |  |
> | *error* | `str` |  |
> | *action* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.rateLimit
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `ip4` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *query_name* | `str` |  |
> | *dns_view* | `str` |  |
> | *info* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.resolver
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.rpz
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *action* | `str` |  |
> | *zone* | `str` |  |
> | *qname_entries* | `int4` |  |
> | *nsdname_entries* | `int4` |  |
> | *ip_entries* | `int4` |  |
> | *nsip_entries* | `int4` |  |
> | *clientip_entries* | `int4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.security
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *query_name* | `str` |  |
> | *dns_view* | `str` |  |
> | *security_info* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [ddi.infoblox.dns.unknown](#tag25)
> - [ddi.infoblox.dns.update](#tag26)
> - [ddi.infoblox.dns.updateSecurity](#tag27)
> - [ddi.infoblox.dns.xferIn](#tag28)
> - [ddi.infoblox.dns.xferOut](#tag29)
> - [ddi.infoblox.nios](#tag30)
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.unknown
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.update
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *zone* | `str` |  |
> | *dns_view* | `str` |  |
> | *action* | `str` |  |
> | *update_info* | `str` |  |
> | *rr_action* | `str` |  |
> | *record* | `str` |  |
> | *type* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.updateSecurity
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *zone* | `str` |  |
> | *dns_view* | `str` |  |
> | *update_info* | `str` |  |
> | *action* | `str` |  |
> | *class* | `str` |  |
> | *permission* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.xferIn
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *zone* | `str` |  |
> | *class* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *transfer_info* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.dns.xferOut
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *ib_category* | `str` |  |
> | *message* | `str` |  |
> | *client_object* | `str` |  |
> | *client_ip* | `str` |  |
> | *port* | `int4` |  |
> | *dns_client_signer* | `str` |  |
> | *dns_view* | `str` |  |
> | *action* | `str` |  |
> | *zone* | `str` |  |
> | *class* | `str` |  |
> | *transfer_info* | `str` |  |
> | *type* | `str` |  |
> | *transfer_status* | `str` |  |
> | *since_serial* | `int8` |  |
> | *serial* | `int8` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.nios
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | eventdate | `timestamp` |  |  |
> | hostname | `str` |  |  |
> | subtype | `str` | *vsubtype* |  |
> | server | `str` |  |  |
> | pid | `int4` |  |  |
> | message | `str` |  |  |
> | hostchain | `str` |  | **✓** |
> | tag | `str` |  | **✓** |
> | rawMessage | `str` |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [ddi.infoblox.nios.monitor](#tag31)
> - [ddi.infoblox.nios.ntpd](#tag32)
> - [ddi.infoblox.nios.ntpdate](#tag33)
> - [ddi.infoblox.nios.rabbitmq_control](#tag34)
> - [ddi.infoblox.nios.syslog-ng](#tag35)
> - [ddi.infoblox.unknown.unknown](#tag36)
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.nios.monitor
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.nios.ntpd
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessa*ge | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.nios.ntpdate
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessa*ge | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.nios.rabbitmq_control
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessa*ge | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.nios.syslogNg
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessa*ge | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ddi.infoblox.unknown.unknown
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *server* | `str` |  |
> | *pid* | `int4` |  |
> | *message* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessa*ge | `str` | **✓** |