This file is indexed.

/usr/share/munin/plugins/named is in munin-plugins-extra 2.0.6-4+deb7u2.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
#!/bin/sh
# -*- sh -*-

: << =cut

=head1 NAME

named - Plugin to monitor named statistics

=head1 ABOUT

This is a bit experimental, we will have to see which statistics prove to have
any meaning to get a feel with what happens on the nameserver.

=head1 USAGE

In your named.conf you must have statistics-interval set:

 options {
    ...
    statistics-interval 1;
    ...
 };

The number is in minutes.  At each interval just 3 lines is dumped.  It can be
desturbing if you usually read the logs yourself, but a 1 minute interval
ensures very updated information to munin.  5 minutes is the maximum I'd say.

The name of the file where syslog puts daemon output - ie the named statistics
output.  On solaris this is /var/adm/messages, on most linuxes it is
/var/log/messages.  But on Debian it is /var/log/daemon.log which is read
restricted so we have to run as a group or user with read rights, or remove the
restrictions on the log file.

=head1 CONFIGURATION

Configuration parameters for /etc/munin/named,
if you need to override the defaults below:

 [named]
  env.logfile   - set which log file to use

To ensure read access to the log files, you will need to add something like:

 [named]
  group adm

=head2 DEFAULT CONFIGURATION

 [named]
  env.logfile /var/adm/messages or /var/log/daemon.log

=head1 AUTHOR

Nicolai Langfeldt (janl@linpro.no) 27.8.2003

=head1 LICENSE

GPLv2

=head1 MAGIC MARKERS

=begin comment

These magic markers are used by munin-node-configure when installing
munin-node.

=end comment

 #%# family=contrib

=cut

if [ -n "$logfile" ]; then
    SYSLOGFILE=$logfile
else 
    if [ -f /var/adm/messages ]; then
	SYSLOGFILE=/var/adm/messages
    else
	SYSLOGFILE=/var/log/daemon.log
    fi
fi

# ----------------------------------------------------------------------

pick_stat () {
    ret=`echo "$2" | sed "s/.* *$1=\([0-9]*\).*/\1/"`
    if [ ! "$ret" ]; then
    	echo 0;
    else
    	echo $ret
    fi
}

do_stats () {

    if [ ! -f $SYSLOGFILE ] ; then 
	echo $SYSLOGFILE is unavailable to me >&2
	exit 1
    fi

    # Get out the last XSTATS and NSTATS lines
    XSTATS=`grep 'named.*XSTATS' "$SYSLOGFILE" | tail -1`
    # NSTATS=`grep 'named.*NSTATS' "$SYSLOGFILE" | tail -1`

    # We concentrate on what clients communicate with us about
    # and counters that we suspect can indicate abuse or error conditions

    # Received Queries: Total volume of queries received. 
    # This should be nice and smooth.
    echo "queries.value `pick_stat RQ "$XSTATS"`"

    # Sent Answers: This should be the same as RQ except when there are
    # errors.  May not be very interesting.
    echo "answers.value `pick_stat SAns "$XSTATS"`"

    # Sent and Forwarded queries, in a proxy setting this should be
    # the same as Received Queries (?)
    echo "forwarded.value `pick_stat SFwdQ "$XSTATS"`" 

    # Received Zone Transfer queries - should be low.  High value could
    # indicate some odd error or some kind of abuse
    echo "axfr.value `pick_stat RAXFR "$XSTATS"`"	# Received AXFR Qs

    # Received TCP connections: These are used for zone transfers or
    # oversized (>512 byte) answers.  A high value here could indicate
    # that you need to trim down the size of your answers somehow (Do you
    # have a ton of MXes or NSes that gets reported back?), or this could
    # be due to an error.  Or it could be due to abuse.
    echo "tcp.value `pick_stat RTCP "$XSTATS"`"
    
    # Get a total of errors
    errexpr="
	    `pick_stat RNXD "$XSTATS"` +
	    `pick_stat RFail "$XSTATS"` +
	    `pick_stat RErr "$XSTATS"` +
	    `pick_stat SErr "$XSTATS"` +
	    `pick_stat RIQ "$XSTATS"` + 
	    `pick_stat RFErr "$XSTATS"` ";

    echo "errors.value `expr $errexpr`"
}

case $1 in
    config)
	cat <<'EOF'
graph_title BIND DNS Query statistics
graph_vlabel Queries / ${graph_period}
graph_scale no
queries.label Queries
queries.type DERIVE
queries.min 0
answers.label Answers
answers.type DERIVE
answers.min 0
forwarded.label Forwarded
forwarded.type DERIVE
forwarded.min 0
axfr.label AXFRs
axfr.type DERIVE
axfr.min 0
tcp.label Qs by TCP
tcp.type DERIVE
tcp.min 0
errors.label Errors
errors.type DERIVE
errors.min 0
EOF
	exit 0
	;;
esac

do_stats