[dns-operations] simple measurement

[Wessels, Duane]

On Dec 21, 2010, at 10:10 PM, Randy Bush wrote:

> i run a couple of small auth servers.  i measure nothing <blush> other
> than checking query rates occasionally.  i should measure some simple
> things such as high zone use, hi A/MX use and failure.  what simple
> tools/hacks are out there?  i might prefer a simple daily report in
> email, as i have for monitoring a whole bunch of non-dns servers.  but i
> am open to other ideas.


You could get most of that with dnscap + dnstop.

Use dnscap to capture 24hrs worth of DNS packets, then feed it to
dnstop for reporting.  Its almost as simple as


  dnscap -i fxp0 -w /tmp/dnscap -t 86400 -k 'dnstop -Q -R | Mail $USER'

Except that you'd need to write a shell script to replace the embedded
dnstop command|pipe because dnscap appends the filename to the end of the -k
command.  Plus you'd want to remove or do something with the pcap files
so they don't accumulate.

https://tools.isc.org/svn/dnscap/branches/wessels/
http://dns.measurement-factory.com/tools/dnstop/

Duane W.