Atlas ITSI Content Pack for ISC BIND
Overview
Details
The ITSI Content Pack for ISC-Bind contains service definitions and KPIs ready to import to ITSI. The KPI Thresholds and importance values are set to defaults so that they can be tuned manually for your use case. After configuration, this content pack provides a comprehensive monitoring solution for ISC-Bind DNS services.
Presidio Splunk Solutions ITSI Content Pack Blog
For more information about Presidio Splunk Solutions' Splunk Products, visit our website.
Services
ISC-Bind monitoring encompasses several specialized services, each targeting specific aspects of DNS performance:
- BIND
- Description: BIND DNS server, representing server and service health.
- DNS_Service
- Description: The primary DNS service responsible for handling all DNS-related operations.
- Bind_Server_Health
- Description: The server running the BIND software, which is the backbone of the DNS service.
- DNS_Queries
- Description: Handles the processing of incoming DNS queries.
- DNS_Responses
- Description: Manages the responses sent back to DNS queries.
- DNS_Cache
- Description: Manages the DNS cache to improve query response times.
- DNS_Zone_Transfer
- Description: Manages the transfer of DNS zone data between servers.
- DNS_Security
- Description: Handles security-related aspects of the DNS service, including DNSSEC.
KPIs
Each service utilizes specific KPIs to measure its effectiveness:
- CPU Pct
- Description: The percentage of CPU being used by the Bind server.
- Memory Pct
- Description: The percentage of memory being used by the Bind server.
- Uptime
- Description: The amount of time the Bind server has been running.
- Disk IO
- Description: The rate of disk input/output operations.
- Network IO
- Description: The rate of network input/output operations.
- Query Rate
- Description: The rate at which DNS queries are being processed.
- Query Errors
- Description: The number of errors encountered while processing DNS queries.
- Recursive Rate
- Description: The rate at which recursive DNS queries are being processed.
- Recursive Errors
- Description: The number of errors encountered while processing recursive DNS queries.
- Response Rate
- Description: The rate at which DNS responses are being sent.
- Response Errors
- Description: The number of errors encountered while sending DNS responses.
- Latency
- Description: The time taken to respond to DNS queries.
- NXDOMAIN Rate
- Description: The rate of NXDOMAIN responses.
- Cache Hit Rate
- Description: The rate at which DNS queries are being served from the cache.
- Cache Miss Rate
- Description: The rate at which DNS queries are not found in the cache and need to be resolved.
- Cache Size
- Description: The size of the DNS cache.
- Zone Transfer Rate
- Description: The rate of DNS zone transfers.
- Zone Transfer Errors
- Description: The number of errors encountered during DNS zone transfers.
- Zone Transfer Success
- Description: The success rate of DNS zone transfers.
- DNSSEC Failures
- Description: The number of DNSSEC validation failures.
- Unauthorized Access
- Description: The number of unauthorized access attempts.
- DDoS Events
- Description: The number of DDoS attack events detected.
- Security Events
- Description: The number of security-related events.
Relationships
Dependencies:
Services are interconnected; for instance, DNS_Service is dependent on the Bind_Server and other services like DNS_Queries, DNS_Responses, DNS_Cache, DNS_Zone_Transfer, and DNS_Security. Similarly, DNS_Responses relies on DNS_Queries for generating responses.
Hierarchical Structure:
Some services form a hierarchy, such as DNS_Queries depending on Bind_Server, illustrating a layered approach to DNS monitoring where base metrics support broader performance indicators.
Release Notes
Version 1.0.0
Documentation Update