ask/prometheus-dnssec-exporter
1
0
Fork 0
Code Pull Requests Projects Releases Activity
33d7d1aacf
prometheus-dnssec-exporter/README.md

105 lines
3.8 KiB
Markdown
Raw Normal View History

first commit
2018-10-04 10:36:49 +00:00
# DNSSEC Exporter for Prometheus
Check for validity and expiration in DNSSEC signatures and expose metrics for Prometheus
## Installation
$ go get -u github.com/chrj/prometheus-dnssec-exporter
## Usage
Usage of prometheus-dnssec-exporter:
-config string
Configuration file (default "/etc/dnssec-checks")
-listen-address string
Prometheus metrics port (default ":9204")
Use external resolvers to validate the signatures.
2018-11-10 14:18:26 +00:00
-resolvers string
Resolvers to use (comma separated) (default "8.8.8.8:53,1.1.1.1:53")
first commit
2018-10-04 10:36:49 +00:00
-timeout duration
Timeout for network operations (default 10s)
## Metrics
### Gauge: `dnssec_zone_record_days_left`
Number of days the signature will be valid.
Labels:
* `zone`
* `record`
* `type`
Improve collection of RRSIG expiration times (#3) * Improve collection of RRSIG expiration times A new record_earliest_rrsig_expiry metric contains the unixtime of the earliest expiring signature per resolver. This allows for different alerting configurations when monitoring a mix of authoritative and caching resolvers. Use a single DNS query instead of querying for RRSIG separately. While some resolvers (reasonably enough) return REFUSED when queried for type RRSIG, they will include relevant RRSIG records when queried for other types (as required by RFC 4034). * Document the improved RRSIG expiration handling While here, also clarify the limitations of the record_days_left metric.
2022-09-24 23:52:08 +00:00
If more than one resolver is configured, the metric will be calculated from the
resolver that is configured first. If more than one RRSIG covers the record,
the number of days until the first one expires will be returned. If the record
is not signed of the signature cannot be validated, this metric will contain a
bogus timestamp.
### Gauge: `dnssec_zone_record_earliest_rrsig_expiry`
Earliest expiring RRSIG covering the record on resolver in unixtime.
Labels:
* `resolver`
* `zone`
* `record`
* `type`
If more than one RRSIG covers the record, the expiration time returned will be
of the one that expires earliest. If the record does not resolve or cannot be
validated, this metric will be absent.
Use external resolvers to validate the signatures.
2018-11-10 14:18:26 +00:00
### Gauge: `dnssec_zone_record_resolves`
first commit
2018-10-04 10:36:49 +00:00
Use external resolvers to validate the signatures.
2018-11-10 14:18:26 +00:00
Does the record resolve using the specified DNSSEC enabled resolvers.
first commit
2018-10-04 10:36:49 +00:00
Labels:
Use external resolvers to validate the signatures.
2018-11-10 14:18:26 +00:00
* `resolver`
first commit
2018-10-04 10:36:49 +00:00
* `zone`
* `record`
* `type`
Improve collection of RRSIG expiration times (#3) * Improve collection of RRSIG expiration times A new record_earliest_rrsig_expiry metric contains the unixtime of the earliest expiring signature per resolver. This allows for different alerting configurations when monitoring a mix of authoritative and caching resolvers. Use a single DNS query instead of querying for RRSIG separately. While some resolvers (reasonably enough) return REFUSED when queried for type RRSIG, they will include relevant RRSIG records when queried for other types (as required by RFC 4034). * Document the improved RRSIG expiration handling While here, also clarify the limitations of the record_days_left metric.
2022-09-24 23:52:08 +00:00
This metric will return 1 only if the record resolves **and** validates.
first commit
2018-10-04 10:36:49 +00:00
### Examples
# HELP dnssec_zone_record_days_left Number of days the signature will be valid
# TYPE dnssec_zone_record_days_left gauge
Use external resolvers to validate the signatures.
2018-11-10 14:18:26 +00:00
dnssec_zone_record_days_left{record="@",type="SOA",zone="ietf.org"} 320.3333333333333
dnssec_zone_record_days_left{record="@",type="SOA",zone="verisigninc.com"} 9.333333333333334
# HELP dnssec_zone_record_resolves Does the record resolve using the specified DNSSEC enabled resolvers
# TYPE dnssec_zone_record_resolves gauge
dnssec_zone_record_resolves{record="@",resolver="1.1.1.1:53",type="SOA",zone="ietf.org"} 1
dnssec_zone_record_resolves{record="@",resolver="1.1.1.1:53",type="SOA",zone="verisigninc.com"} 1
dnssec_zone_record_resolves{record="@",resolver="8.8.8.8:53",type="SOA",zone="ietf.org"} 1
dnssec_zone_record_resolves{record="@",resolver="8.8.8.8:53",type="SOA",zone="verisigninc.com"} 1
Improve collection of RRSIG expiration times (#3) * Improve collection of RRSIG expiration times A new record_earliest_rrsig_expiry metric contains the unixtime of the earliest expiring signature per resolver. This allows for different alerting configurations when monitoring a mix of authoritative and caching resolvers. Use a single DNS query instead of querying for RRSIG separately. While some resolvers (reasonably enough) return REFUSED when queried for type RRSIG, they will include relevant RRSIG records when queried for other types (as required by RFC 4034). * Document the improved RRSIG expiration handling While here, also clarify the limitations of the record_days_left metric.
2022-09-24 23:52:08 +00:00
# HELP dnssec_zone_record_earliest_rrsig_expiry Earliest expiring RRSIG covering the record on resolver in unixtime
# TYPE dnssec_zone_record_earliest_rrsig_expiry gauge
dnssec_zone_record_earliest_rrsig_expiry{record="@",resolver="1.1.1.1:53",type="SOA",zone="ietf.org"} 1.664872679e+09
dnssec_zone_record_earliest_rrsig_expiry{record="@",resolver="1.1.1.1:53",type="SOA",zone="verisigninc.com"} 1.664778306e+09
dnssec_zone_record_earliest_rrsig_expiry{record="@",resolver="8.8.8.8:53",type="SOA",zone="ietf.org"} 1.664872679e+09
dnssec_zone_record_earliest_rrsig_expiry{record="@",resolver="8.8.8.8:53",type="SOA",zone="verisigninc.com"} 1.664778306e+09
first commit
2018-10-04 10:36:49 +00:00
## Configuration
Supply a configuration file path with `-config` (optionally, defaults to `/etc/dnssec-checks`). Uses [TOML](https://github.com/toml-lang/toml).
[Sample configuration file](config.sample)
## Prometheus target
Supply a listen address with `-addr` (optionally, defaults to `:9204`), and configure a Prometheus job:
- job_name: "dnssec"
scrape_interval: "1m"
static_configs:
- targets:
- "server:9204"
## Prometheus alert
The real benefit is getting an alert triggered when a signature is nearing expiration or is not longer valid. Check this [sample alert definition](dnssec.rules).
Copy Permalink