Monitoring the DNS

The first network component we will analyze and see how to monitor is the DNS.

The most popular DNS server is BIND, which is also one of the oldest packages produced. Here, in the next example, we assume you have BIND 9.6 or later.

Starting with version 9.6, there is a brand new feature that is not even mentioned in the main page (of Red Hat Linux at least). This feature is a built-in web server that provides statistics about BIND in a very simple way thought HTTP. To enable this feature, it is enough to add those lines to your BIND9 configuration file, /etc/named.conf:

statistics-channels {
  inet 127.0.0.1 port 8053 allow { 127.0.0.1; };
};

The line we have just added is a good example as the statistics' access is controlled and restricted to the localhost.

Tip

BIND, by default, will use the standard 80 HTTP port if you don't specify the port. Also please take care to limit the access to the statistic channel; to do so, you can use this clause:

allow {  address_match_list ...