mirror of
https://github.com/prometheus-community/windows_exporter.git
synced 2026-10-18 10:39:05 +02:00
Jan-Otto Kröpke
d819362150
Every optional collector of the mixin now has alerts, generated only with that collector enabled in _config.collectors: clock source, disk drive status, page file usage, license status, scheduled task results, pending updates, Hyper-V WMI and replication health, failover cluster nodes, resources, groups and shared volumes, Storage Spaces pool and virtual disk health, DHCP scope exhaustion and DNS zone transfer failures. The alerts of the pagefile, diskdrive and license collectors join the memory, disk and system groups; the other collectors get a group of their own. New knobs: taskSelector, sharedVolumeSelector, pagefileUsageThreshold, dhcpScopeFreeWarningThreshold, dhcpScopeFreeCriticalThreshold and updatePendingDuration. The test configuration enables every optional collector and tests/optional.test.yaml covers the new alerts. Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
55 lines
2.4 KiB
Markdown
55 lines
2.4 KiB
Markdown
---
|
|
title: WindowsDNSZoneTransferFailures
|
|
---
|
|
|
|
## Meaning
|
|
|
|
The DNS server has failed zone transfers for 15 minutes, measured as the rate
|
|
of `windows_dns_zone_transfer_failures_total` over `rateInterval` above
|
|
`dnsZoneTransferFailureRateThreshold`, zero by default. The counter counts
|
|
transfers this server sends as the primary to its secondaries, including
|
|
requests it refuses, and it has no zone label. The alert needs the `dns`
|
|
collector and keeps firing for `keepFiringFor` after the failures stop. Raise
|
|
the threshold on servers that refuse transfer requests from scanners all the
|
|
time.
|
|
|
|
## Impact
|
|
|
|
The secondary servers of the zone serve stale records. When the zone on a
|
|
secondary expires, it stops answering for the zone altogether. Active
|
|
Directory integrated zones replicate through Active Directory and are not
|
|
affected unless they also have secondaries.
|
|
|
|
## Diagnosis
|
|
|
|
1. Inspect `windows_dns_zone_transfer_failures_total` next to
|
|
`windows_dns_zone_transfer_requests_received_total` and
|
|
`windows_dns_zone_transfer_success_sent_total` to see what share of the
|
|
transfers fail, and whether the failures started with a change.
|
|
2. On this primary, find the refused or failed requests and the zone
|
|
settings; the DNS Server log records a refused transfer request with the
|
|
address of the requester:
|
|
|
|
```powershell
|
|
Get-WinEvent -LogName 'DNS Server' -MaxEvents 100 | Where-Object Message -match 'zone transfer'
|
|
Get-DnsServerZone | Where-Object { $_.ZoneType -eq 'Primary' } | Get-DnsServerZoneTransferPolicy
|
|
Get-DnsServerZone -Name '<zone>' | Select-Object ZoneName, SecureSecondaries, SecondaryServers, NotifyServers
|
|
```
|
|
|
|
On the secondary, events 6522 to 6527 of the DNS Server log say why its
|
|
transfer of the zone failed: refused by the primary, invalid response or
|
|
an expired zone.
|
|
|
|
3. Check that the requesting secondary is in the zone transfer list, that TCP
|
|
port 53 is open between the servers, and that the zone is not paused or
|
|
broken. Failures from unknown addresses are refused transfers and may be
|
|
expected.
|
|
|
|
## Mitigation
|
|
|
|
Add the secondary to the allowed servers with `Set-DnsServerPrimaryZone -SecureSecondaries`
|
|
and the server list, fix the network path, or remove a decommissioned
|
|
secondary from the zone's notify list so it stops requesting transfers.
|
|
Confirm the failure counter stops rising and the secondaries show a current
|
|
serial number.
|