Which metrics are useful for monitoring?

[io7m]

Obviously unbound_up is useful for monitoring in the sense that alerting can alert to a non-zero or absent value.

For the other exposed metrics, it's not clear what might indicate some sort of problem requiring an alert.

Anyone got a useful set of alerting rules they use?

[kovaga]

Thats what I monitor with unbound and NSD

- name: Kos Unbound Rules
    rules:
      - alert: UnboundServiceDown
        expr: unbound_up == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Unbound DNS service is down"
          description: "The Unbound DNS service on {{ $labels.instance }} has been down for more than 5 minutes."

      - alert: UnboundHighQueryRate
        expr: '(rate(unbound_queries_total[15m])) / (rate(unbound_queries_total[1d])) > 3'
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High Unbound DNS Query Rate"
          description: "The DNS query rate on {{ $labels.instance }} has been more than 3 times the previous 24-hour average for over 5 minutes."

      - alert: UnboundHighResponseTime
        expr: histogram_quantile(0.99, rate(unbound_response_time_seconds_bucket[5m])) > 1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High Unbound DNS response time"
          description: "The 99th percentile of DNS query response times on {{ $labels.instance }} is above 1 second."


 - name: Kos NSD Rules
    rules:
      - alert: NSDServiceDown
        expr: nsd_up == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "NSD DNS service is down"
          description: "The iNSD DNS service on {{ $labels.instance }} has been down for more than 5 minutes."

      - alert: NSDHighQueryRate
        expr: '(rate(nsd_server_queries[15m])) / (rate(nsd_server_queries[1d])) > 3'
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High NSD DNS Query Rate"
          description: "The DNS query rate on {{ $labels.instance }} has been more than 3 times the previous 24-hour average for over 5 minutes."

      - alert: NsdMasterZonesCountChange
        expr: nsd_zone_master != (nsd_zone_master offset 5m)
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Number of Nsd master zones has changed"
          description: "The number of master zones on {{ $labels.instance }} is now {{ $value }}."

      - alert: NsdSlaveZonesCountChange
        expr: nsd_zone_slave != (nsd_zone_slave offset 5m)
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Number of Nsd slave zones has changed"
          description: "The number of slave zones on {{ $labels.instance }} is now {{ $value }}."

[io7m]

Thanks!