Reading the log

What an entry tells you

Every entry has three useful parts: the device that asked, the domain it asked for, and the time it asked. The device is identified by its local IP — the dashboard maps these to names you set. The domain is the name being resolved. The time tells you the rhythm.

Normal traffic

Most of the log is normal. App update servers, CDN domains, push notification services, the handful of sites you actually visit. Normal traffic has two qualities: you can roughly explain it, and it does not change much. The same devices reaching the same domains at the same kind of cadence.

The three signals to watch

Heron tags entries so you do not have to read the whole log. There are three classes worth your attention.

• flagged-domain — the queried domain matches a known suffix on the flagged list. Usually telemetry, ad, or tracking infrastructure.
• new-connection — a device making its first observed connection to a domain it has never reached before while you have been watching.
• normal — neither of the above. The bulk of the log.

The flagged field is true for both flagged-domain and new-connection classes. The dashboard and the buzzer use that field to surface what matters.

Patterns over single entries

One weird domain is usually nothing. A device suddenly reaching a new domain every ten minutes on the minute is a pattern. A device that was quiet for three days and now checks in to a telemetry endpoint hourly is a change. Read the log for changes in shape, not for individual bad rows.

What to ignore

CDN and app-update traffic will dominate the volume and is almost never interesting. The dashboard's activity feed filters the noise; the raw log is there when you want the ground truth. Do not try to read every entry. Read the flagged ones, then the new ones, then stop.