Attached is a modified version of dns.monitor with the following changes:
Added -serial_threshold command line argument to allow the zone serials
between the master and the slaves by that much, at most. Necessary to
avoid spurious errors during zone propagation. High thresholds are
typically unnecessary, but when using Dynamic DNS, with zones that update
hundreds if not thousands of times an hour, they can be off by quite a bit
but still be OK. If propagation completely fails, eventually we'll exceed
the threshold.
Added a mode for monitoring caching only name servers. Give the
-caching_only argument, and then instead of -zone and -master arguments,
you specify -query arguments, which are of the form record[:type]. (With
A records being the default type) So you might specify '-query
myzone.com:MX -query myzone.com:A -query _servicename._udp.myzone.com:SRV'
Every server will be queried for each request, and must return a valid
response. But the records will NOT be cross checked against each other,
as various round-robin DNS situations may cause the different servers to
have different data.
Fixed some error reporting code to format the output better
Changed the script exit value to be the highest count of how many servers
failed on a single query. (I.e. if three servers are queried, for 20
records, the highest error code possible is 3, not 20 as it was before)
I found all of these changes to be necessary in our environment, and none
of them greatly change the original behavior, so I figured they were worth
submitting. I would just submit a diff, but a context diff was actually
BIGGER then just sending the whole file...
-David Nolan
Network Software Developer
Computing Services
Carnegie Mellon University
#!/usr/bin/perl
#
# Copyright (C) 1998 David Eckelkamp
# Copyright (C) 2002 David Nolan
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# $Id: dns.monitor,v 1.6 2002/09/04 12:39:08 vitroth Exp $
#
=head1 NAME
dns.monitor - Monitor DNS servers for the "mon" system
=head1 SYNOPSIS
B<dns.monitor> I<-zone zone [-zone zone ...]> I<-master master> I<[-serial_threshold
num]> I<server [server ...]>
or
B<dns.monitor> I<-caching_only> I<-query record[:type] [-query record[:type] ...]>
I<server [server ...]>
=head1 DESCRIPTION
B<dns.monitor> will make several DNS queries to verify that a server is
operating correctly
In normal mode, B<dns.monitor> will compare the zones between a master
server and one or more slave servers. The I<zone> argument is the
zone to check. There can be multiple I<zone> arguments. The I<master>
argument is the master server for the I<zone>. It will be queried for
the base information. Then each I<server> will be queried to verify
that it has the correct answers. If the I<serial_threshold> argument
is provided, the slave servers must return a zone whose serial number
is no more than the threshold from the serial number of the zone on
the master. (Zone serial numbers may not be identical during zone
propagation, or on Dynamic DNS zones which may be updated hundreds or
thousands of times an hour) It is assumed that each I<server> is
supposed to be authoritative for the I<zone>.
In caching mode, specified via the I<-caching_only> switch, B<dns.monitor>
will perform a set of DNS queries to one or more servers. The I<query>
argument is the query to perform. The query may have an optional query type
specified as I<:type> on the end of the query. I.e your.zone.com:MX will
cause B<dns.monitor> to fetch the MX records for your.zone.com. There can be
multiple I<query> arguments. Each I<server> will be contacted to verify
that it returns a valid response to the query. If you wish to use
B<dns.monitor> to verify that a caching DNS server is actually fetching fresh
data from other servers successfully, it is recommended that the DNS records
you query should have very short TTLs.
The exit code of B<dns.monitor> will be the highest number of servers which
failed on a single zone/query, 0 if no problems occurred, or -1 if an error
with the script arguments was detected.
=head1 AUTHOR
The script was originally written by David Eckelkamp <[EMAIL PROTECTED]>
The script was modified to support Caching DNS servers and frequently updating Zone
serials by David Nolan <[EMAIL PROTECTED]>
=cut
#use strict;
use Getopt::Long;
use English;
use File::Basename;
use Net::DNS::Resolver;
use Net::DNS::Packet;
use Net::DNS::RR;
my($Program) = basename($0);
my(@Zones) = ();
my(@Queries) = ();
my($Master) = undef;
my($SerialThreshold) = (0);
my($CachingServer) = (0);
my(%OptVars) = ("master" => \$Master,
"zone" => \@Zones,
"serial_threshold" => \$SerialThreshold,
"caching_only" => \$CachingServer,
"query" => \@Queries);
if (!GetOptions(\%OptVars, "master=s", "zone=s@", "serial_threshold=s",
"caching_only", "query=s@")) {
print STDERR "Problems with Options, sorry\n";
exit -1;
}
if ( $#ARGV < 0 ) {
print STDERR "$Program: at least one server must be specified\n";
exit -1;
}
if (!$CachingServer) {
if (!defined($Master)) {
print STDERR "$Program: The zone master server must be specified\n";
exit -1;
}
if ( !defined(@Zones) ) {
print STDERR "$Program: At least one zone must be specified\n";
exit -1;
}
} else {
if ( !defined(@Queries) ) {
print STDERR "$Program: At least one query must be specified\n";
exit -1;
}
}
if (!$CachingServer) {
my($err_cnt) = 0;
my($bad_servers, $reason, $failcount, @FailedZones, @FailedServers, @Reasons);
my($zone, $line, $i);
$maxfailcount = 0;
foreach $zone (@Zones) {
($bad_servers, $reason, $failcount) = dns_verify($zone, $Master, @ARGV);
if (defined($bad_servers)) {
$err_cnt = $failcount if ($failcount > $err_cnt);
push(@FailedZones, $zone);
push(@FailedServers, $bad_servers);
push(@Reasons, $reason);
}
}
@FailedServers=split(' ',join(" ",@FailedServers));
my (@UniqFailedServers, %saw);
@saw{@FailedServers} = ();
@UniqFailedServers = keys %saw;
if ($err_cnt > 0) {
print join(" ", @UniqFailedServers);
print "\n";
# Now print the detail lines
for ($i=0; $i<=$#FailedZones; $i++) {
print "Zone '$FailedZones[$i]': failed servers: $FailedServers[$i]\n";
print "Diagnostics:\n";
foreach $line (split("\n", $Reasons[$i])) {
print " $line\n";
}
print "\n";
}
}
exit $err_cnt;
} else {
my($err_cnt) = 0;
my($bad_servers, $reason, $failcount, @FailedQuerys, @FailedServers, @Reasons);
my($query, $type, $line, $i);
foreach (@Queries) {
($query, $type) = split /:/;
$type = 'A' if ($type eq "");
($bad_servers, $reason, $failcount) = dns_test($query, $type, @ARGV);
if (defined($bad_servers)) {
$err_cnt = $failcount if ($failcount > $err_cnt);
push(@FailedQuerys, "$query $type");
push(@FailedServers, $bad_servers);
push(@Reasons, $reason);
}
}
@FailedServers=split(' ',join(" ",@FailedServers));
my (@UniqFailedServers, %saw);
@saw{@FailedServers} = ();
@UniqFailedServers = keys %saw;
if ($err_cnt > 0) {
print join(" ", @UniqFailedServers);
print "\n";
# Now print the detail lines
for ($i=0; $i<=$#FailedQuerys; $i++) {
print "Query '$FailedQuerys[$i]': failed servers: $FailedServers[$i]\n";
print "Diagnostics:\n";
foreach $line (split("\n", $Reasons[$i])) {
print " $line\n";
}
print "\n";
}
}
exit $err_cnt;
}
# dns_verity($zone, $master, $server, ...)
# This subroutine takes 3 or more arguments. The first argument is the name of
# the DNS zone/domain to check. The second argument is the name of the DNS
# server you consider to be the master of the given zone. The subroutine
# will make a DNS query to the the master to get the SOA for the zone and
# extract the serial number. The third and rest of the arguments are taken as
# names of slave DNS servers. Each server will be queried for the SOA of the
# given zone and the serial number will be checked against that found in the
# SOA record on the master server. By default the zone serials must be
# the same. This may be overridden by the serial_threshold command line
# argument.
# The return value is a 3 element list. The first element is a space delimited
# string containing the names of the slave servers that did not match the
# master zone. The second element is a string containing the diagnostic
# output that should explain the problem encountered. The third element is a count
# of how many servers failed, which will be used as the exit code.
sub dns_verify {
# First verify that we have enough arguments.
my($Zone, $Master, @Servers) = @_;
my($result) = undef;
my(@failed, $res, $soa_req, $Serial, $error_cnt, $server);
# Query the $Master for the SOA of $Zone and get the serial number.
$res = new Net::DNS::Resolver;
$res->defnames(0); # don't append default zone
$res->recurse(0); # no recursion
$res->retry(2); # 2 retries before failure
$res->nameservers($Master);
$soa_req = $res->query($Zone, "SOA");
if (!defined($soa_req) || ($soa_req->header->ancount <= 0)) {
return($Master,
sprintf("SOA query for $Zone from $Master failed %s\n",
$res->errorstring));
}
unless ($soa_req->header->aa) {
return($Master,
sprintf("$Master is not authoritative for $Zone\n"));
}
unless ($soa_req->header->ancount == 1) {
return($Master,
sprintf("Too many answers for SOA query to %s for %s\n",
$Master,
$Zone));
}
unless (($soa_req->answer)[0]->type eq "SOA") {
return($Master,
printf("Query for SOA for %s from %s failed: " .
"return type = %s\n",
$Zone,
$Master,
($soa_req->answer)[0]->type),
scalar @Servers);
}
$Serial = ($soa_req->answer)[0]->serial;
# Now, foreach server given on the command line, get the serial number from
# the SOA and compare it to the master.
$error_cnt = 0;
foreach $server (@Servers) {
$res = new Net::DNS::Resolver;
$res->defnames(0); # don't append default zone
$res->recurse(0); # no recursion
$res->retry(2); # 2 retries before failure
$res->nameservers($server);
$soa_req = $res->query($Zone, "SOA");
if (!defined($soa_req) || ($soa_req->header->ancount <= 0)) {
$error_cnt++;
push(@failed, $server);
$result .= sprintf("\nSOA query for $Zone from $server failed %s\n",
$res->errorstring);
next;
}
unless(($soa_req->header->aa || $CachingServer) && $soa_req->header->ancount
== 1 &&
($soa_req->answer)[0]->type eq "SOA" &&
((abs(($soa_req->answer)[0]->serial - $Serial))
<= $SerialThreshold)) {
$error_cnt++;
push(@failed, $server);
$result .= sprintf("\nQuery to $server about $Zone failed\n" .
"Authoritative = %s\n" .
"Answer count = %d\n" .
"Answer Type = %s\n" .
"Serial number = %s, should have been %s\n" ,
$soa_req->header->aa ? "yes" : "no",
$soa_req->header->ancount,
($soa_req->answer)[0]->type,
($soa_req->answer)[0]->serial,
$Serial);
next;
}
}
if ($error_cnt == 0) {
return(undef, undef, undef);
} else {
return("@failed", $result, $error_cnt);
}
}
# dns_test($query, $type, $server, ...)
# This subroutine takes 3 or more arguments. The first argument is the name of
# the DNS record to query. The second argument is the type of the DNS
# query to perform. The third and rest of the arguments are taken as
# names of caching DNS servers. Each server will be queried for the
# given record and type
# The return value is a 3 element list. The first element is a space delimited
# string containing the names of the servers that failed to respond to the
# query. The second element is a string containing the diagnostic
# output that should explain the problem encountered. The third element is the
# count of how many servers failed, which will be used as the exit code.
sub dns_test {
# First verify that we have enough arguments.
my($Query, $Master, @Servers) = @_;
my($result) = undef;
my(@failed, $res, $soa_req, $Serial, $error_cnt, $server);
# Now, foreach server given on the command line,
# make the query
$error_cnt = 0;
foreach $server (@Servers) {
$res = new Net::DNS::Resolver;
$res->defnames(0); # don't append default zone
$res->recurse(0); # no recursion
$res->retry(2); # 2 retries before failure
$res->nameservers($server);
$soa_req = $res->query($Query, $type);
if (!defined($soa_req) || ($soa_req->header->ancount <= 0)) {
$error_cnt++;
push(@failed, $server);
$result .= sprintf("\n$type query for $Query from $server failed %s\n",
$res->errorstring);
next;
}
}
if ($error_cnt == 0) {
return(undef, undef, undef);
} else {
return("@failed", $result, $error_cnt);
}
}
