Looking for a way to grab named stats from DNS servers and output them to Elastic for better visibility

What is the best way to grab the named stats such as Resolver Statistics (IPv4 queries sent, IPv4 responses received etc) and Cache Statistics (cache hits, cache misses etc) and parse them to be able to visualize them on a dashboard with Elastic. The named_stats.txt file on the DNS master and DNS slaves have this file that has a ton of stats that can be helpful in troubleshooting DNS issues for us. We currently leverage logstash for most our queries today.

Example output of named_stats.txt:

++ Cache Statistics ++
[View: default]
              195374 IPv4 queries sent
              195307 IPv4 responses received
               13600 NXDOMAIN received
                5188 SERVFAIL received
                2683 query retries
                  67 query timeouts
                4066 queries with RTT < 10ms
              184536 queries with RTT 10-100ms
                6670 queries with RTT 100-500ms
                  20 queries with RTT 500-800ms
                  15 queries with RTT 800-1600ms
                 523 bucket size
                2572 spilled due to server quota
[View: _bind]

++ Cache Statistics ++
[View: default]
              712227 cache hits
              195628 cache misses
              380050 cache hits (from query)
              325574 cache misses (from query)
                   0 cache records deleted due to memory exhaustion
               17819 cache records deleted due to TTL expiration
                 630 cache database nodes
                 519 cache database hash buckets
             2418422 cache tree memory total
              247299 cache tree memory in use
              323080 cache tree highest memory in use
              393216 cache heap memory total
              132096 cache heap memory in use
              132096 cache heap highest memory in use
[View: _bind (Cache: _bind)] 

Welcome to our community! :smiley:

I don't believe we have a good way to do this at the moment and it'd be some funky, custom parsing (given the file format) with Filebeat to get it into Elasticsearch.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.