mirror of
https://github.com/prometheus-community/windows_exporter.git
synced 2026-10-19 11:09:03 +02:00
55 lines
2.4 KiB
Markdown
55 lines
2.4 KiB
Markdown
---
|
|
title: WindowsDNSZoneTransferFailures
|
|
---
|
|
|
|
## Meaning
|
|
|
|
The DNS server has failed zone transfers for 15 minutes, measured as the rate
|
|
of `windows_dns_zone_transfer_failures_total` over `rateInterval` above
|
|
`dnsZoneTransferFailureRateThreshold`, zero by default. The counter counts
|
|
transfers this server sends as the primary to its secondaries, including
|
|
requests it refuses, and it has no zone label. The alert needs the `dns`
|
|
collector and keeps firing for `keepFiringFor` after the failures stop. Raise
|
|
the threshold on servers that refuse transfer requests from scanners all the
|
|
time.
|
|
|
|
## Impact
|
|
|
|
The secondary servers of the zone serve stale records. When the zone on a
|
|
secondary expires, it stops answering for the zone altogether. Active
|
|
Directory integrated zones replicate through Active Directory and are not
|
|
affected unless they also have secondaries.
|
|
|
|
## Diagnosis
|
|
|
|
1. Inspect `windows_dns_zone_transfer_failures_total` next to
|
|
`windows_dns_zone_transfer_requests_received_total` and
|
|
`windows_dns_zone_transfer_success_sent_total` to see what share of the
|
|
transfers fail, and whether the failures started with a change.
|
|
2. On this primary, find the refused or failed requests and the zone
|
|
settings; the DNS Server log records a refused transfer request with the
|
|
address of the requester:
|
|
|
|
```powershell
|
|
Get-WinEvent -LogName 'DNS Server' -MaxEvents 100 | Where-Object Message -match 'zone transfer'
|
|
Get-DnsServerZone | Where-Object { $_.ZoneType -eq 'Primary' } | Get-DnsServerZoneTransferPolicy
|
|
Get-DnsServerZone -Name '<zone>' | Select-Object ZoneName, SecureSecondaries, SecondaryServers, NotifyServers
|
|
```
|
|
|
|
On the secondary, events 6522 to 6527 of the DNS Server log say why its
|
|
transfer of the zone failed: refused by the primary, invalid response or
|
|
an expired zone.
|
|
|
|
3. Check that the requesting secondary is in the zone transfer list, that TCP
|
|
port 53 is open between the servers, and that the zone is not paused or
|
|
broken. Failures from unknown addresses are refused transfers and may be
|
|
expected.
|
|
|
|
## Mitigation
|
|
|
|
Add the secondary to the allowed servers with `Set-DnsServerPrimaryZone -SecureSecondaries`
|
|
and the server list, fix the network path, or remove a decommissioned
|
|
secondary from the zone's notify list so it stops requesting transfers.
|
|
Confirm the failure counter stops rising and the secondaries show a current
|
|
serial number.
|