zabbix_export: version: '6.0' date: '2021-11-21T21:36:39Z' groups: - uuid: 7df96b18c230490a9a0a9e2307226338 name: Templates templates: - uuid: e69fd8b062bf4f94ae58ee1aa310f9db template: 'Bind queries' name: 'Bind queries' description: | ## Description /etc/zabbix/zabbix_agentd.d/userparameter_bind.conf: UserParameter=bind.tcpcl,/bin/cat /tmp/namedtcp.log UserParameter=bind.udpcl,/bin/cat /tmp/namedudp.log --------------- cron every 30 sec: /var/spool/cron/root: SHELL=/bin/sh PATH=/sbin:/bin:/usr/sbin:/usr/bin 0-59 * * * * /etc/zabbix/custom/named.sh 0-59 * * * * ( sleep 30; /etc/zabbix/custom/named.sh ) /etc/zabbix/custom/named.sh: #!/bin/bash /usr/local/named/sbin/rndc status > /tmp/rndcstatus cat /tmp/rndcstatus | grep tcp | awk '{ print $3 }' | cut -d '/' -f 1 > /tmp/namedtcp.log cat /tmp/rndcstatus | grep recursive | awk '{ print $3 }' | cut -d '/' -f 1 > /tmp/namedudp.log ----------------------------- add key for rndc in config of named ## Overview Shows recursive queries on your BIND server. Triggers on excesive usage. Best for caching servers. Instalation description: /etc/zabbix/zabbix\_agentd.d/userparameter\_bind.conf: UserParameter=bind.tcpcl,/bin/cat /tmp/namedtcp.log UserParameter=bind.udpcl,/bin/cat /tmp/namedudp.log --------------- cron every 30 sec: /var/spool/cron/root: SHELL=/bin/sh PATH=/sbin:/bin:/usr/sbin:/usr/bin 0-59 * * * * /etc/zabbix/custom/named.sh 0-59 * * * * ( sleep 30; /etc/zabbix/custom/named.sh ) chmod +x /etc/zabbix/custom/named.sh: #!/bin/bash /usr/local/named/sbin/rndc status > /tmp/rndcstatus cat /tmp/rndcstatus | grep tcp | awk '{ print $3 }' | cut -d '/' -f 1 > /tmp/namedtcp.log cat /tmp/rndcstatus | grep recursive | awk '{ print $3 }' | cut -d '/' -f 1 > /tmp/namedudp.log ----------------------------- add key for rndc in config of named groups: - name: Templates items: - uuid: cd7984ee9ea841799b425d4db04b603e name: 'Recursive TCP' key: bind.tcpcl delay: 30s units: requests tags: - tag: Application value: NS - uuid: 662234d58af548c69b6ad78e94f6c471 name: 'Recursive UDP' key: bind.udpcl delay: 30s units: requests tags: - tag: Application value: NS triggers: - uuid: 48e9aa4b58504da19d5e56da4b6d4532 expression: | last(/Bind queries/bind.udpcl,#2)>200 or last(/Bind queries/bind.tcpcl,#2)>30 name: 'Too much recursive queries on {HOST.NAME}' priority: WARNING graphs: - uuid: cc332f9540864d8fa6cded125a2827f2 name: 'Recursive queries' graph_items: - color: 1A7C11 item: host: 'Bind queries' key: bind.tcpcl - sortorder: '1' color: F63100 item: host: 'Bind queries' key: bind.udpcl