dnsdist: ring buffers would benefit from sampling
- Program: dnsdist
- Issue type: Feature request
Short description
The ring buffers hold the last N queries and responses seen by dnsdist, and are used by a lot of features like topXXX commands, grepq but also our dynamic rules.
The default size, 10k entries, holds barely 1s of traffic at 10k qps, and thus might not be enough for huge setups. While the number of entries can be increased (and should when needed, along with sharding), there is a trade-off between memory use (around 250 MB for 1M entries) and the cost of walking so many entries, which is why we don't advise to store more than 1M entries. Still some rules might benefit from being able to know how the traffic was over a longer period of time.
For that reason it would be nice to be able to do sampling instead, keeping perhaps 1 out of 10 queries and responses in the ring buffers.
We will probably need to make the sampling rate available to consumers of the information located in the ring buffers, like the dynamic block, so they can infer the actual rate.