Learn about server status through DNS logs

When the DNS server is running, a set of LOG_INFO-level logs are generated every one hour to report the running status of the DNS server:
Dec 26 10:23:52 www named [1033]: Cleaned cache of 26 RRset
Dec 26 10:23:52 www named [1033]: USAGE 977797432 976760631 CPU = 6.55u/6.24 s child cpu = 0u/0 s
Dec 26 10:23:52 www named [1033]: NSTATS 977797432 976760631 0 = 2 A = 13192
CNAME = 321 PTR = 11204 MX = 1173 TXT = 4 AAAA = 32 ANY = 4956
Dec 26 10:23:52 www named [1033]: XSTATS 977797432 976760631 RR = 7629 RNXD = 1368
RFwdR = 4836 RDupR = 51 RFail = 159 RFErr = 0 RErr = 12 RAXFR = 0 RLame = 175 ROpts = 0
SSysQ = 2082 SAns = 26234 SFwdQ = 4520 SDupQ = 1263 SErr = 0 RQ = 30889 RIQ = 4 RFwdQ = 0
RDupQ = 259 RTCP = 2 SFwdR = 4836 SFail = 6 SFErr = 0 snans = 21753 SNXD = 10276

Next we will explain it one by one:
1. Dec 26 10:23:52 www named [1033]: Cleaned cache of 26 RRset
This is the first line of each set of log information, indicating that the Cache is being cleared.
Where:
Dec 26 10:23:52 indicates the log generation time
Www display the name of the machine where the DNS server is located
Named [1033]: displays the DNS server process name and process ID.
Cleaned cache of 26 RRset indicates that the cache is being cleared
2. Dec 26 10:23:52 www named [1033]: USAGE 977797432 976760631 CPU = 6.55u
/6.24 s child cpu = 0u/0 s
This row is the USAGE line used to count the CPU time occupied by the DNS server.
Where:
Dec 26 10:23:52 indicates the log generation time
Www display the name of the machine where the DNS server is located
Named [1033]: displays the DNS server process name and process ID.
USAGE row mark
The value of 977797432 976760631 977797432-976760631 is the total number of seconds that the DNS server runs.
CPU = 6.55u/6.24 s indicates that the DNS server uses the user State for 6.55 seconds, and the system state for 6.24 seconds (u indicates the user,
S stands for system ),
The child cpu represents the CPU usage of the DNS server sub-process.
3. Dec 26 10:23:52 www named [1033]: NSTATS 977797432 976760631 0 = 2 A = 13192
CNAME = 321 PTR = 11204 MX = 1173 TXT = 4 AAAA = 32 ANY = 4956
This row is an NSTATS row used to count the total number of received queries.
Where:
Dec 26 10:23:52 indicates the log generation time
Www display the name of the machine where the DNS server is located
Named [1033]: displays the DNS server process name and process ID.
NSTATS row mark
The value of 977797432 976760631 977797432-976760631 is the total number of seconds that the DNS server runs.
0 = 2 represents two DNS queries of unknown type
A = 13192 represents 13192 Class A address queries (the most standard)
CNAME = 321 indicates that 321 CNAME class addresses are queried. (generally, some versions of sendmail use the CNAME program.
The canonicalized email address is also sent by dig or nslookup)
PTR = 11204 indicates that the pointer queries 11204 (many software uses this method to find IP addresses)
MX = 1173 indicates 1173 email exchanges (initiated by the email sending Program)
TXT = 4 indicates that the application performs a total of 4 text queries.
AAAA = 32 indicates 32 AAAA queries
ANY = 4956 some Sendmail Address query methods, a total of 4956
Note: There may also be:
NS = xx indicates the Name Server Query (for example, the name server tries to find the root domain server)
SOA = xx indicates secondary DNS update
HINFO = xx host Information Query
NSAP = xx maps the domain name to the OSI Network Service Access Point address
AXFR = xx secondary DNS zone transfer
These do not appear in this example.
4. Dec 26 10:23:52 www named [1033]: XSTATS 977797432 976760631 RR = 7629 RNXD = 1368
RFwdR = 4836 RDupR = 51 RFail = 159 RFErr = 0 RErr = 12 RAXFR = 0 RLame = 175 ROpts = 0 SSysQ = 2082
SAns = 26234 SFwdQ = 4520 SDupQ = 1263 SErr = 0 RQ = 30889 RIQ = 4 RFwdQ = 0
RDupQ = 259 RTCP = 2
SFwdR = 4836 SFail = 6 SFErr = 0 snans = 21753 SNXD = 10276
This is an XSTATS row used to count other data.
Where:
Dec 26 10:23:52 indicates the log generation time
Www display the name of the machine where the DNS server is located
Named [1033]: displays the DNS server process name and process ID.
NSTATS row mark
The value of 977797432 976760631 977797432-976760631 is the total number of seconds that the DNS server runs.
RR = 7629 indicates that a total of 7629 responses are received from other hosts (the number of responses obtained from queries sent by DNS to other machines or processes,
Irrelevant to RQ)
RNXD = 1368 indicates that a total of 1368 answers were received "No such domain ".
RFwdR = 108 receive 108 responses to the original query
RDupR = 51 repeated responses: 51 (when the DNS does not find the original query that caused the response in its pending query list,
This response is a repeated response)
RFail = 159 received 159 SERVFAIL (Remote Server Error)
RFErr = 0 didn't receive FORMERR (the remote name server considers that the query of the local name server has a format error)
Rerr = 12 receive 12 errors except SERVFAIL and FORMERR
RAXFR = 0 0 total 0 transfers
RLame = 175 receive 175 bad authorizations (meaning some zones are authorized to other name servers, and this name server is not
Region Authority)
ROpts = 0 total number of packets with IP option received is 0
SSysQ = 2082 a total of 2082 system queries were issued (system queries are performed by the local name server. Most of them are
Root Name Server)
SAns = 26234 answered a total of 26234 queries
SFwdQ = 4520 is not on this name server, but there are a total of 4520 forwarding entries.
SDupQ = 1263 repeated queries: 1263
SErr = 0 Total Number of non-SERVFAIL and FORMERR errors
RQ = 30889 a total of 30889 queries are received
RIQ = 4 received four reverse queries (reverse query is used to map the address to the name, and now this function is implemented by PTR. Earlier
Nslookup of to use this query)
RFwdQ = 0 no query to be further processed
RDupQ = 259 a total of 259 duplicate queries
RTCP = 2 receive two queries over TCP connections (generally UDP)
SFwdR = 4836 responses forwarded by other name servers: 4836
SFail = 6 6 SERVFAIL responses
SFErr = 0 Number of FORMERR responses
Snail ans = 21753 unauthoritative answers totaling 21753
SNXD = 10276: no answer for this domain

These statistics are the total statistics from the DNS activation to the present, rather than the statistics in this hour. How to measure the DNS server's
What about the load? It's easy to simply divide the total number of queries by the total time of DNS running. Don't you know? In this example, the DNS server is running
Now: 977797432-976760631 = 1036801 seconds = 288 hours
Note: You can obtain data from lines 2nd, 3, and 4.
Total query requests include: 2 + 13192 + 321 + 11204 + 1173 + 4 + 32 + 4956 = 20884
Note: You can obtain the number of rows from 2nd, that is, 107 query requests per hour, less than two times per second. It can be seen that the load is still relatively small.