Skip to main content

Monitoring BIND

BIND is recognised by its named process and monitored with the tools it ships with: rndc status for the client counts, named-checkconf for the real path of the query log, and the query log itself for the query rate. Nothing is configured for the agent; BIND itself needs rndc set up and query logging on for two of the signals, as explained below.

How BIND is recognised​

The signed definition matches a host running a process named named. Once matched, every 60 seconds the agent dials 127.0.0.1:53 over TCP, runs named -v for the version, named-checkconf -p to print the effective configuration, and rndc status. From the printed configuration it picks the logging channel whose file name contains quer and follows that file for the query rate. The log tail reads only what was appended since its last pass.

What is collected​

Clients. rndc status reports how many recursive clients are being served against the configured ceiling, and how many TCP clients are connected. The agent records the two counts.

Query rate. Lines carrying query: in the query log are counted into queries per second.

Liveness. A TCP connection to port 53 on the loopback address has to be accepted.

Facts shown on the host page: version and the query log path.

SignalMetric
Recursive clients in flightsvc.bind.recursive_clients
TCP clients connectedsvc.bind.tcp_clients
Queries per secondsvc.bind.query_rate

Names, tags and units are in the metrics reference.

Logs. The journal entries of named ship at notice level and above. Query log lines are info by nature, so they are collected only when you switch the service to full depth in the console. See Logs.

Alerts out of the box​

RuleFires whenSeverityShips
BIND recursion slots nearly full900 or more recursive clients for 5 minuteswarningoff

The rule ships off because the number only means something against your own recursive-clients ceiling: 900 assumes the default of 1000, and a resolver tuned to 10000 would never reach it while one capped at 500 would be in trouble long before. Enable it in the console when you run the default, or copy it with your own ceiling. It closes once clients drop under 700. Thresholds and hysteresis are in the rules catalog.

When a path is not where BIND says it is​

The query log path comes from named-checkconf -p. If the channel writes to a file whose name does not contain quer, or the log is kept elsewhere, point the agent at it:

sudo wakora --set bind.query-log=/var/log/named/queries.log

Keys are listed in Agent configuration.

Limitations​

  • rndc status needs rndc configured: a controls statement in named.conf and a key that rndc can read. Without it the status probe fails and the two client counts are missing; the other probes are unaffected.
  • The query rate needs query logging enabled and a logging channel that writes to a file whose name contains quer. Query logging is off unless you turn it on.
  • Liveness is checked over TCP on 127.0.0.1:53. UDP is not probed, and a named that does not listen on the loopback address fails the check.
  • Zone transfers, per-zone counters and the rndc stats dump are not collected.