Jan-Otto Kröpke
d819362150
Every optional collector of the mixin now has alerts, generated only with that collector enabled in _config.collectors: clock source, disk drive status, page file usage, license status, scheduled task results, pending updates, Hyper-V WMI and replication health, failover cluster nodes, resources, groups and shared volumes, Storage Spaces pool and virtual disk health, DHCP scope exhaustion and DNS zone transfer failures. The alerts of the pagefile, diskdrive and license collectors join the memory, disk and system groups; the other collectors get a group of their own. New knobs: taskSelector, sharedVolumeSelector, pagefileUsageThreshold, dhcpScopeFreeWarningThreshold, dhcpScopeFreeCriticalThreshold and updatePendingDuration. The test configuration enables every optional collector and tests/optional.test.yaml covers the new alerts. Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
2.4 KiB
title
| title |
|---|
| WindowsDNSZoneTransferFailures |
Meaning
The DNS server has failed zone transfers for 15 minutes, measured as the rate
of windows_dns_zone_transfer_failures_total over rateInterval above
dnsZoneTransferFailureRateThreshold, zero by default. The counter counts
transfers this server sends as the primary to its secondaries, including
requests it refuses, and it has no zone label. The alert needs the dns
collector and keeps firing for keepFiringFor after the failures stop. Raise
the threshold on servers that refuse transfer requests from scanners all the
time.
Impact
The secondary servers of the zone serve stale records. When the zone on a secondary expires, it stops answering for the zone altogether. Active Directory integrated zones replicate through Active Directory and are not affected unless they also have secondaries.
Diagnosis
-
Inspect
windows_dns_zone_transfer_failures_totalnext towindows_dns_zone_transfer_requests_received_totalandwindows_dns_zone_transfer_success_sent_totalto see what share of the transfers fail, and whether the failures started with a change. -
On this primary, find the refused or failed requests and the zone settings; the DNS Server log records a refused transfer request with the address of the requester:
Get-WinEvent -LogName 'DNS Server' -MaxEvents 100 | Where-Object Message -match 'zone transfer' Get-DnsServerZone | Where-Object { $_.ZoneType -eq 'Primary' } | Get-DnsServerZoneTransferPolicy Get-DnsServerZone -Name '<zone>' | Select-Object ZoneName, SecureSecondaries, SecondaryServers, NotifyServersOn the secondary, events 6522 to 6527 of the DNS Server log say why its transfer of the zone failed: refused by the primary, invalid response or an expired zone.
-
Check that the requesting secondary is in the zone transfer list, that TCP port 53 is open between the servers, and that the zone is not paused or broken. Failures from unknown addresses are refused transfers and may be expected.
Mitigation
Add the secondary to the allowed servers with Set-DnsServerPrimaryZone -SecureSecondaries
and the server list, fix the network path, or remove a decommissioned
secondary from the zone's notify list so it stops requesting transfers.
Confirm the failure counter stops rising and the secondaries show a current
serial number.