Overview

Sensu Check to provide DNS latecy metrics and basic domain resolution health check

References

• sensu-plugins/sensu-plugins-dns (MIT License)
• Telegraf dns_query plugin (MIT License)
• Telegraf bind plugin (MIT License)
• Prometheus bind exporter
• Prometheus blackbox exporter
• Using the blackbox exporter blog post
• Datadog Agent dns_check integration (3-clause BSD style license)
• Datadog integration docs
• Golang package implementing DNSSEC validation
• Golang package examples

Configuration

• --domain comma delimited list of domains
• --server comma delimited list of dns servers to use for queries
• --class specific record class to query default to IN
• --type specific record type to query default to A
• --port dns server port to query, default to 53
• --validate-dnssec return insecure-status if any domain entries are found to be insecure
• --insecure-status default to 1
• --validate-resolution return unresolved-status if any domain entries are unresolved
• --unresolved-status default to 1

Configuration Logic & Validation

• Validate --domain is set
• Validate --server is set
• Validate --class is in acceptable list of strings
• Validate --type is in acceptable list of strings
• Validate name servers list in --server are valid name servers

Metrics

• dns_response_time guage: query response_time for a given query in units of seconds only include if domain resolves
• dns_resolved guage: 0 - success, 1 - failure
• dns_secure guage: 0 - secure, 1 - insecure

required tags

• domain: query domain
• record_class: query record class
• record_type: query record type
• server: name server queried

Health Checks

dnssec validation

• when --validate-dnssec option in use the check can return non-zero to indicate at least one domain is not secure

resolution validation

• when --validate-resolution option in use the check can return non-zero to indicate at least one domain did not resolve
• use future metric threshold feature to set min threshold for a specific domain.

Catalog Templates

• example using common public domain servers to resolve domain

TODO

TBD:

Out of scope:

Though the gauge generating a float, the help text indicates that the result should be binary. The float is a bit misleading and we should probably just make it either a 0 or 1.