bind – dns server queries statistics with statistics-file

There is an option “statistics-file” in the BIND9 configuration for query statistics. It will give you statistics for

  • Incoming Requests – total number of queries
  • Incoming Queries – queries by record type
  • Outgoing Queries – queries by record type per view
  • Name Server Statistics – extended queries statistics by network connection type (UDP, TCP or IPv4 and IPv6 interface), by type of answer (authoritative, non authoritative and so on) and more
  • Zone Maintenance Statistics – transfer and system queries
  • Resolver Statistics – recursive queries
  • Cache DB RRsets – cached resources records sets
  • Socket I/O Statistics – statistics numbers for UDP, TCP (for both IPv4 and IPV6) sockets and connections opened, closed, failure
  • Per Zone Query Statistics – so you can see how many queries you have for a zone in a view (and the transfers if the server is a slave)

In named.conf:

options {
....
    statistics-file "/var/log/named.stats";
    zone-statistics yes ;
....

But if you check in /var/log this file might be missing even your BIND server has been running for months!

This is because the statistics and the file is generated on request and is a snapshot at the moment you do the request

To request from the BIND server to generate the file is pretty easy:

root@srv ~ # rndc stats
root@srv ~ #

No standard output and you should have the stats file generated:

root@srv ~ # ls -altr /var/log/named.stats 
-rw-r--r-- 1 named named 174997 Apr  7 01:43 /var/log/named.stats

The generated requests are appended in the file with a UNIX timestamp.

....
--- Statistics Dump --- (1550561292)
+++ Statistics Dump +++ (1551233218)
....


Here we offer you almost the whole output of one of our slave BIND servers. We included all sections (some of the data is changed):

+++ Statistics Dump +++ (1551233218)
++ Incoming Requests ++
            13223384 QUERY
                 749 NOTIFY
++ Incoming Queries ++
            11414281 A
               10319 NS
                  18 CNAME
               39524 SOA
                   4 MX
                  12 TXT
             1741399 AAAA
                6998 SRV
                 110 A6
                2504 DS
                   1 DNSKEY
                8194 AXFR
                  18 ANY
++ Outgoing Queries ++
[View: am-new-york]
[View: am-denver]
[View: am-sanfrancisco]
[View: am-dallas]
[View: am-vancouver]
[View: am-others]
[View: sydney-us]
[View: sydney-eu]
[View: de]
[View: uk]
[View: ca]
[View: eu]
                 375 A
                 523 NS
                 262 AAAA
                 139 SRV
[View: _bind]
++ Name Server Statistics ++
            13224134 IPv4 requests received
            12869583 requests with EDNS(0) received
                8943 requests with TSIG received
                8201 TCP requests received
                 143 auth queries rejected
                  17 recursive queries rejected
            13215914 responses sent
            12861389 responses with EDNS(0) sent
            11315902 queries resulted in successful answer
            13185087 queries resulted in authoritative answer
               30050 queries resulted in non authoritative answer
             1840559 queries resulted in nxrrset
               58676 queries resulted in NXDOMAIN
                 805 queries caused recursion
                  26 duplicate queries received
                  25 other query failures
                8194 requested transfers completed
++ Zone Maintenance Statistics ++
                 749 IPv4 notifies received
              181977 IPv4 SOA queries sent
               63727 IPv4 IXFR requested
               63508 transfer requests succeeded
                 219 transfer requests failed
++ Resolver Statistics ++
[Common]
[View: am-new-york]
[View: am-denver]
[View: am-sanfrancisco]
[View: am-dallas]
[View: am-vancouver]
[View: am-others]
[View: sydney-us]
[View: sydney-eu]
[View: de]
[View: uk]
[View: ca]
[View: eu]
                1299 IPv4 queries sent
                1299 IPv4 responses received
                 169 NXDOMAIN received
                 789 queries with RTT 10-100ms
                 508 queries with RTT 100-500ms
                   2 queries with RTT 800-1600ms
[View: _bind]
++ Cache DB RRsets ++
[View: am-new-york (Cache: am-new-york)]
[View: am-denver (Cache: am-denver)]
[View: am-sanfrancisco (Cache: am-sanfrancisco)]
[View: am-dallas (Cache: am-dallas)]
[View: am-vancouver (Cache: am-vancouver)]
[View: am-others (Cache: am-others)]
[View: sydney-us (Cache: sydney-us)]
[View: sydney-eu (Cache: sydney-eu)]
[View: de (Cache: de)]
[View: uk (Cache: uk)]
[View: ca (Cache: ca)]
[View: eu (Cache: eu)]
                   9 A
                   1 NS
                   9 CNAME
                   2 AAAA
                   1 RRSIG
                   8 !AAAA
                   3 NXDOMAIN
[View: _bind (Cache: _bind)]
++ Socket I/O Statistics ++
               50331 UDP/IPv4 sockets opened
               63733 TCP/IPv4 sockets opened
               50326 UDP/IPv4 sockets closed
               71932 TCP/IPv4 sockets closed
                   2 UDP/IPv4 socket bind failures
                1299 UDP/IPv4 connections established
               63727 TCP/IPv4 connections established
                8207 TCP/IPv4 connections accepted
                   3 TCP/IPv4 send errors
++ Per Zone Query Statistics ++
[dns-example-1.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-2.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-3.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-4.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-5.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-6.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-7.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-8.com (view: am-new-york)]
                  35 requested transfers completed
[dns-example-9.com (view: am-new-york)]
                  35 requested transfers completed
[10.10.10.in-addr.arpa (view: am-new-york)]
                  35 requested transfers completed
[10.10.20.in-addr.arpa (view: am-new-york)]
                  35 requested transfers completed
[10.10.30.in-addr.arpa (view: am-new-york)]
                  35 requested transfers completed
[10.10.40.in-addr.arpa (view: am-new-york)]
                  35 requested transfers completed
[10.IN-ADDR.ARPA (view: am-new-york)]
[16.172.IN-ADDR.ARPA (view: am-new-york)]
[17.172.IN-ADDR.ARPA (view: am-new-york)]
[18.172.IN-ADDR.ARPA (view: am-new-york)]
.....
.....
[dns-example-1.com (view: am-sanfrancisco)]
                  34 requested transfers completed
[dns-example-2.com (view: am-sanfrancisco)]
                1395 queries resulted in successful answer
                1685 queries resulted in authoritative answer
                 290 queries resulted in nxrrset
                  34 requested transfers completed
[dns-example-3.com (view: am-sanfrancisco)]
                  87 queries resulted in successful answer
                  91 queries resulted in authoritative answer
                   4 queries resulted in nxrrset
                  34 requested transfers completed
[dns-example-4.com (view: am-sanfrancisco)]
                  34 requested transfers completed
[dns-example-5.com (view: am-sanfrancisco)]
                  35 requested transfers completed
[dns-example-6.com (view: am-sanfrancisco)]
                  34 requested transfers completed
[dns-example-7.com (view: am-sanfrancisco)]
                  34 requested transfers completed
[dns-example-8.com (view: am-sanfrancisco)]
                  34 requested transfers completed
[dns-example-9.com (view: am-sanfrancisco)]
                 737 queries resulted in successful answer
                 882 queries resulted in authoritative answer
                 145 queries resulted in nxrrset
                  34 requested transfers completed
[10.10.10.in-addr.arpa (view: am-sanfrancisco)]
                  34 requested transfers completed
[10.10.20.in-addr.arpa (view: am-sanfrancisco)]
                  34 requested transfers completed
[10.10.30.in-addr.arpa (view: am-sanfrancisco)]
                  34 requested transfers completed
[10.10.40.in-addr.arpa (view: am-sanfrancisco)]
                  34 requested transfers completed
.....
.....
[dns-example-1.com (view: am-vancouver)]
                  35 requested transfers completed
[dns-example-2.com (view: am-vancouver)]
                  11 queries resulted in successful answer
                  11 queries resulted in authoritative answer
                  35 requested transfers completed
[dns-example-3.com (view: am-vancouver)]
                 716 queries resulted in successful answer
                 716 queries resulted in authoritative answer
                  35 requested transfers completed
[dns-example-4.com (view: am-vancouver)]
                  35 requested transfers completed
[dns-example-5.com (view: am-vancouver)]
                  35 requested transfers completed
[dns-example-6.com (view: am-vancouver)]
                  35 requested transfers completed
[dns-example-7.com (view: am-vancouver)]
                  35 requested transfers completed
[dns-example-8.com (view: am-vancouver)]
                  35 requested transfers completed
[dns-example-9.com (view: am-vancouver)]
                 140 queries resulted in successful answer
                 278 queries resulted in authoritative answer
                 138 queries resulted in nxrrset
                  35 requested transfers completed
[10.10.10.in-addr.arpa (view: am-vancouver)]
                  35 requested transfers completed
[10.10.20.in-addr.arpa (view: am-vancouver)]
                  35 requested transfers completed
[10.10.30.in-addr.arpa (view: am-vancouver)]
                  35 requested transfers completed
[10.10.40.in-addr.arpa (view: am-vancouver)]
                  35 requested transfers completed
.....
.....
[dns-example-1.com (view: am-others)]
                2153 queries resulted in successful answer
                2156 queries resulted in authoritative answer
                   3 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-2.com (view: am-others)]
              197157 queries resulted in successful answer
              201604 queries resulted in authoritative answer
                4434 queries resulted in nxrrset
                  13 queries resulted in NXDOMAIN
                  35 requested transfers completed
[dns-example-3.com (view: am-others)]
                2526 queries resulted in successful answer
                2571 queries resulted in authoritative answer
                  45 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-4.com (view: am-others)]
                 235 queries resulted in successful answer
                 235 queries resulted in authoritative answer
                  35 requested transfers completed
[dns-example-5.com (view: am-others)]
                  35 requested transfers completed
[dns-example-6.com (view: am-others)]
                  35 requested transfers completed
[dns-example-7.com (view: am-others)]
                  35 requested transfers completed
[dns-example-8.com (view: am-others)]
                  35 requested transfers completed
[dns-example-9.com (view: am-others)]
               12342 queries resulted in successful answer
               14416 queries resulted in authoritative answer
                2074 queries resulted in nxrrset
                  35 requested transfers completed
[10.10.10.in-addr.arpa (view: am-others)]
                  35 requested transfers completed
[10.10.20.in-addr.arpa (view: am-others)]
                  35 requested transfers completed
[10.10.30.in-addr.arpa (view: am-others)]
                  35 requested transfers completed
[10.10.40.in-addr.arpa (view: am-others)]
                  35 requested transfers completed
[10.IN-ADDR.ARPA (view: am-others)]
.....
.....
[dns-example-1.com (view: sydney-us)]
                  36 requested transfers completed
[dns-example-2.com (view: sydney-us)]
                2098 queries resulted in successful answer
                3945 queries resulted in authoritative answer
                1847 queries resulted in nxrrset
                  36 requested transfers completed
[dns-example-3.com (view: sydney-us)]
                 427 queries resulted in successful answer
                1043 queries resulted in authoritative answer
                 616 queries resulted in nxrrset
                  36 requested transfers completed
[dns-example-4.com (view: sydney-us)]
                  36 requested transfers completed
[dns-example-5.com (view: sydney-us)]
                  36 requested transfers completed
[dns-example-6.com (view: sydney-us)]
                  36 requested transfers completed
[dns-example-7.com (view: sydney-us)]
                  36 requested transfers completed
[dns-example-8.com (view: sydney-us)]
                  36 requested transfers completed
[dns-example-9.com (view: sydney-us)]
                  62 queries resulted in successful answer
                 118 queries resulted in authoritative answer
                  56 queries resulted in nxrrset
                  36 requested transfers completed
[10.10.10.in-addr.arpa (view: sydney-us)]
                  36 requested transfers completed
[10.10.20.in-addr.arpa (view: sydney-us)]
                  36 requested transfers completed
[10.10.30.in-addr.arpa (view: sydney-us)]
                  36 requested transfers completed
[10.10.40.in-addr.arpa (view: sydney-us)]
                  36 requested transfers completed
[10.IN-ADDR.ARPA (view: sydney-us)]
.....
.....
[dns-example-1.com (view: sydney-eu)]
                  35 requested transfers completed
[dns-example-2.com (view: sydney-eu)]
                 201 queries resulted in successful answer
                 249 queries resulted in authoritative answer
                  48 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-3.com (view: sydney-eu)]
                  13 queries resulted in successful answer
                  20 queries resulted in authoritative answer
                   7 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-4.com (view: sydney-eu)]
                  35 requested transfers completed
[dns-example-5.com (view: sydney-eu)]
                  35 requested transfers completed
[dns-example-6.com (view: sydney-eu)]
                  35 requested transfers completed
[dns-example-7.com (view: sydney-eu)]
                  35 requested transfers completed
[dns-example-8.com (view: sydney-eu)]
                  35 requested transfers completed
[dns-example-9.com (view: sydney-eu)]
                 100 queries resulted in successful answer
                 100 queries resulted in authoritative answer
                  35 requested transfers completed
[10.10.10.in-addr.arpa (view: sydney-eu)]
                  35 requested transfers completed
[10.10.20.in-addr.arpa (view: sydney-eu)]
                  35 requested transfers completed
[10.10.30.in-addr.arpa (view: sydney-eu)]
                  35 requested transfers completed
[10.10.40.in-addr.arpa (view: sydney-eu)]
                  35 requested transfers completed
.....
.....
[dns-example-1.com (view: de)]
                 244 queries resulted in successful answer
                 303 queries resulted in authoritative answer
                  59 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-2.com (view: de)]
             1362967 queries resulted in successful answer
             1627528 queries resulted in authoritative answer
              264557 queries resulted in nxrrset
                   4 queries resulted in NXDOMAIN
                  35 requested transfers completed
[dns-example-3.com (view: de)]
              123712 queries resulted in successful answer
              143756 queries resulted in authoritative answer
               20044 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-4.com (view: de)]
                  16 queries resulted in successful answer
                  20 queries resulted in authoritative answer
                   4 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-5.com (view: de)]
                  35 requested transfers completed
[dns-example-6.com (view: de)]
                  35 requested transfers completed
[dns-example-7.com (view: de)]
                  35 requested transfers completed
[dns-example-8.com (view: de)]
                  35 requested transfers completed
[dns-example-9.com (view: de)]
               28689 queries resulted in successful answer
               56772 queries resulted in authoritative answer
               28083 queries resulted in nxrrset
                  35 requested transfers completed
[10.10.10.in-addr.arpa (view: de)]
                  35 requested transfers completed
[10.10.20.in-addr.arpa (view: de)]
                  35 requested transfers completed
[10.10.30.in-addr.arpa (view: de)]
                  35 requested transfers completed
[10.10.40.in-addr.arpa (view: de)]
                  35 requested transfers completed
.....
.....
[dns-example-1.com (view: uk)]
                  35 requested transfers completed
[dns-example-2.com (view: uk)]
               14812 queries resulted in successful answer
               14859 queries resulted in authoritative answer
                  47 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-3.com (view: uk)]
                 714 queries resulted in successful answer
                 749 queries resulted in authoritative answer
                  35 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-4.com (view: uk)]
                   4 queries resulted in successful answer
                   6 queries resulted in authoritative answer
                   2 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-5.com (view: uk)]
                  35 requested transfers completed
[dns-example-6.com (view: uk)]
                  35 requested transfers completed
[dns-example-7.com (view: uk)]
                   3 queries resulted in successful answer
                   5 queries resulted in authoritative answer
                   2 queries resulted in nxrrset
                  35 requested transfers completed
[dns-example-8.com (view: uk)]
                  35 requested transfers completed
[dns-example-9.com (view: uk)]
                 294 queries resulted in successful answer
                 584 queries resulted in authoritative answer
                 290 queries resulted in nxrrset
                  35 requested transfers completed
[10.10.10.in-addr.arpa (view: uk)]
                  35 requested transfers completed
[10.10.20.in-addr.arpa (view: uk)]
                  35 requested transfers completed
[10.10.30.in-addr.arpa (view: uk)]
                  35 requested transfers completed
[10.10.40.in-addr.arpa (view: uk)]
                  35 requested transfers completed
.....
.....
[dns-example-1.com (view: eu)]
                3346 queries resulted in successful answer
                3622 queries resulted in authoritative answer
                 276 queries resulted in nxrrset
                  34 requested transfers completed
[dns-example-2.com (view: eu)]
                   1 auth queries rejected
             4727259 queries resulted in successful answer
             5343620 queries resulted in authoritative answer
              614659 queries resulted in nxrrset
                1702 queries resulted in NXDOMAIN
                  34 requested transfers completed
[dns-example-3.com (view: eu)]
              238723 queries resulted in successful answer
              291647 queries resulted in authoritative answer
               52924 queries resulted in nxrrset
                  34 requested transfers completed
[dns-example-4.com (view: eu)]
                5123 queries resulted in successful answer
               45449 queries resulted in authoritative answer
                 988 queries resulted in nxrrset
               39338 queries resulted in NXDOMAIN
                  34 requested transfers completed
[dns-example-5.com (view: eu)]
               16736 queries resulted in successful answer
               36949 queries resulted in authoritative answer
               16714 queries resulted in nxrrset
                3499 queries resulted in NXDOMAIN
                  35 requested transfers completed
[dns-example-6.com (view: eu)]
                   1 queries resulted in successful answer
                   3 queries resulted in authoritative answer
                   2 queries resulted in nxrrset
                  34 requested transfers completed
[dns-example-7.com (view: eu)]
                  34 requested transfers completed
[dns-example-8.com (view: eu)]
                  34 requested transfers completed
[dns-example-9.com (view: eu)]
              109788 queries resulted in successful answer
              205192 queries resulted in authoritative answer
               95404 queries resulted in nxrrset
                  34 requested transfers completed
[10.10.10.in-addr.arpa (view: eu)]
                  34 requested transfers completed
[10.10.20.in-addr.arpa (view: eu)]
                  34 requested transfers completed
[10.10.30.in-addr.arpa (view: eu)]
                  34 requested transfers completed
[10.10.40.in-addr.arpa (view: eu)]
                  34 requested transfers completed
.....
.....
[version.bind (view: _bind)]
                   6 queries resulted in successful answer
                   6 queries resulted in authoritative answer
[hostname.bind (view: _bind)]
                   1 queries resulted in successful answer
                   1 queries resulted in authoritative answer
[authors.bind (view: _bind)]
[id.server (view: _bind)]
                   1 queries resulted in authoritative answer
                   1 queries resulted in nxrrset
--- Statistics Dump --- (1551233218)

Leave a Reply

Your email address will not be published.