aggressive-nsec-cache-entries |
Number of entries in the aggressive NSEC cache. |
aggressiveNSECCacheEntries (108) |
aggressive-nsec-cache-nsec-hits |
Number of NSEC-related hits from the aggressive NSEC cache. |
aggressiveNSECCacheNSECHits (109) |
aggressive-nsec-cache-nsec-wc-hits |
Number of answers synthesized from the NSEC aggressive cache. |
aggressiveNSECCacheNSECWcHits (111) |
aggressive-nsec-cache-nsec3-hits |
Number of NSEC3-related hits from the aggressive NSEC cache. |
aggressiveNSECCacheNSEC3Hits (110) |
aggressive-nsec-cache-nsec3-wc-hits |
Number of answers synthesized from the NSEC3 aggressive cache. |
aggressiveNSECCacheNSEC3WcHits (112) |
all-outqueries |
Number of outgoing queries. |
allOutqueries (59) |
almost-expired-exceptions |
Number of almost-expired tasks that caused an exception. |
almostExpiredExceptions (117) |
almost-expired-pushed |
Number of almost-expired tasks pushed. |
almostExpiredPushed (115) |
almost-expired-run |
Number of almost-expired tasks run to completion. |
almostExpiredRun (116) |
answers-slow |
Number of queries answered in more than 1000 ms. |
answersSlow (26) |
answers0-1 |
Number of queries answered in less than 1 ms. |
answers01 (22) |
answers1-10 |
Number of queries answered in 1-10 ms. |
answers110 (23) |
answers10-100 |
Number of queries answered in 10-100 ms. |
answers10100 (24) |
answers100-1000 |
Number of queries answered in 100-1000 ms. |
answers1001000 (25) |
auth-formerr-answers |
Number of rcode 1 (formerr) answers received. |
authFormerrAnswers (130) |
auth-noerror-answers |
Number of rcode 0 (noerror) answers received. |
authNoerrorAnswers (129) |
auth-notauth-answers |
Number of rcode 9 (notauth) answers received. |
authNotauthAnswers (138) |
auth-notimp-answers |
Number of rcode 4 (notimp) answers received. |
authNotimpAnswers (133) |
auth-nxdomain-answers |
Number of rcode 3 (nxdomain) answers received. |
authNxdomainAnswers (132) |
auth-nxrrset-answers |
Number of rcode 8 (nxrrset) answers received. |
authNxrrsetAnswers (137) |
auth-rcode10-answers |
Number of rcode 10 answers received. |
authRcode10Answers (139) |
auth-rcode11-answers |
Number of rcode 11 answers received. |
authRcode11Answers (140) |
auth-rcode12-answers |
Number of rcode 12 answers received. |
authRcode12Answers (141) |
auth-rcode13-answers |
Number of rcode 13 answers received. |
authRcode13Answers (142) |
auth-rcode14-answers |
Number of rcode 14 answers received. |
authRcode14Answers (143) |
auth-rcode15-answers |
Number of rcode 15 answers received. |
authRcode15Answers (144) |
auth-refused-answers |
Number of rcode 5 (refused) answers received. |
authRefusedAnswers (134) |
auth-servfail-answers |
Number of rcode 2 (servfail) answers received. |
authServfailAnswers (131) |
auth-yxdomain-answers |
Number of rcode 6 (yxdomain) answers received. |
authYxdomainAnswers (135) |
auth-yxrrset-answers |
Number of rcode 7 (yxrrset) answers received. |
authYxrrsetAnswers (136) |
auth-zone-queries |
Number of queries to locally hosted authoritative zones (‘setting-auth-zones’). |
|
auth4-answers-slow |
Number of IPv4 queries answered in more than 1000 ms. |
auth4AnswersSlow (31) |
auth4-answers0-1 |
Number of IPv4 queries answered in less than 1 ms. |
auth4Answers01 (27) |
auth4-answers1-10 |
Number of IPv4 queries answered in 1-10 ms. |
auth4Answers110 (28) |
auth4-answers10-100 |
Number of IPv4 queries answered in 10-100 ms. |
auth4Answers10100 (29) |
auth4-answers100-1000 |
Number of IPv4 queries answered in 100-1000 ms. |
auth4Answers1001000 (30) |
auth6-answers-slow |
Number of IPv6 queries answered in more than 1000 ms. |
auth6AnswersSlow (36) |
auth6-answers0-1 |
Number of IPv6 queries answered in less than 1 ms. |
auth6Answers01 (32) |
auth6-answers1-10 |
Number of IPv6 queries answered in 1-10 ms. |
auth6Answers110 (33) |
auth6-answers10-100 |
Number of IPv6 queries answered in 10-100 ms. |
auth6Answers10100 (34) |
auth6-answers100-1000 |
Number of IPv6 queries answered in 100-1000 ms. |
auth6Answers1001000 (35) |
cache-bytes |
Size of the cache in bytes. Since version 5.3.0 this metric computes a rough estimate of the number of bytes allocated by the record cache. Older versions return a number that cannot be relied upon. Disabled by default, as computing this number is CPU intensive, see recursor.stats_rec_control_disabled_list. |
cacheBytes (7) |
cache-entries |
Number of record cache entries. |
cacheEntries (6) |
cache-hits |
Number of cache hits. This does not include hits that got answered from the packet-cache. |
cacheHits (4) |
cache-misses |
Number of cache misses. This does not include hits that got answered from the packet-cache. |
cacheMisses (5) |
case-mismatches |
Number of case mismatches. |
caseMismatches (39) |
chain-limits |
Chain limits reached. |
chainLimits (151) |
chain-resends |
Number of chain resends. |
chainResends (64) |
client-parse-errors |
Number of client parse errors. |
clientParseErrors (19) |
concurrent-queries |
Number of concurrent queries. |
concurrentQueries (53) |
cpu-iowait |
Time spent waiting for I/O to complete by the whole system, in units of USER_HZ. |
|
cpu-msec-thread-n |
Number of milliseconds spent in thread n. |
|
cpu-steal |
Stolen time, which is the time spent by the whole system in other operating systems when running in a virtualized environment, in units of USER_HZ. |
|
cumul-authanswers-x |
Cumulative counts of answer times to clients in buckets less than x microseconds. Disabled by default, see recursor.stats_rec_control_disabled_list. These metrics are useful for Prometheus and not listed in other outputs by default. |
|
cumul-clientanswers-x |
Cumulative counts of answer times of authoritative servers in buckets less than x microseconds. Disabled by default, see recursor.stats_rec_control_disabled_list. These metrics are useful for Prometheus and not listed in other outputs by default. |
|
dlg-only-drops |
Obsolete. |
dlgOnlyDrops (46) |
dns64-prefix-answers |
Number of answers generated by dns64-prefix matching. |
dns64PrefixAnswers (114) |
dnssec-authentic-data-queries |
Number of queries received with the AD bit set. |
dnssecAuthenticDataQueries (95) |
dnssec-check-disabled-queries |
Number of queries received with the CD bit set. |
dnssecCheckDisabledQueries (96) |
dnssec-queries |
Number of DNSSEC queries. |
dnssecQueries (72) |
dnssec-result-bogus |
Number of responses sent, excluding packet-cache hits, that were in the DNSSEC bogus state. |
dnssecResultBogus (83) |
dnssec-result-bogus-invalid-denial |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid denial of existence proof could not be found. |
|
dnssec-result-bogus-invalid-dnskey-protocol |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because all DNSKEYs had invalid protocols. |
|
dnssec-result-bogus-missing-negative-indication |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a NODATA or NXDOMAIN answer lacked the required SOA and/or NSEC(3) records. |
|
dnssec-result-bogus-no-rrsig |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because required RRSIG records were not present in an answer. |
|
dnssec-result-bogus-no-valid-dnskey |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid DNSKEY could not be found. |
|
dnssec-result-bogus-no-valid-rrsig |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because only invalid RRSIG records were present in an answer. |
|
dnssec-result-bogus-no-zone-key-bit-set |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because no DNSKEY with the Zone Key bit set was found. |
|
dnssec-result-bogus-revoked-dnskey |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because all DNSKEYs were revoked. |
|
dnssec-result-bogus-self-signed-ds |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a DS record was signed by itself. |
|
dnssec-result-bogus-signature-expired |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because the signature expired time in the RRSIG was in the past. |
|
dnssec-result-bogus-signature-not-yet-valid |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because the signature inception time in the RRSIG was not yet valid. |
|
dnssec-result-bogus-unable-to-get-dnskeys |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid DNSKEY could not be retrieved. |
|
dnssec-result-bogus-unable-to-get-dss |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid DS could not be retrieved. |
|
dnssec-result-bogus-unsupported-dnskey-algo |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a DNSKEY RRset contained only unsupported DNSSEC algorithms. |
|
dnssec-result-bogus-unsupported-ds-digest-type |
Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a DS RRset contained only unsupported digest types. |
|
dnssec-result-indeterminate |
Number of responses sent, excluding packet-cache hits, that were in the DNSSEC indeterminate state. |
dnssecResultIndeterminate (84) |
dnssec-result-insecure |
Number of responses sent, excluding packet-cache hits, that were in the DNSSEC insecure state. |
dnssecResultInsecure (81) |
dnssec-result-nta |
Number of responses sent, excluding packet-cache hits, that were in the DNSSEC NTA state. |
dnssecResultNta (85) |
dnssec-result-secure |
Number of responses sent, excluding packet-cache hits, that were in the DNSSEC secure state. |
dnssecResultSecure (82) |
dnssec-validations |
Number of responses sent, packet-cache hits excluded, for which a DNSSEC validation was requested by either the client or the configuration. |
dnssecValidations (80) |
dont-outqueries |
Number of outgoing queries not sent because of a ‘dont-query’ setting. |
dontOutqueries (62) |
dot-outqueries |
Number of outgoing DoT queries. |
dotOutqueries (113) |
ecs-queries |
Number of outgoing queries adorned with an EDNS Client Subnet option. |
|
ecs-responses |
Number of responses received from authoritative servers with an EDNS Client Subnet option we used. |
|
edns-ping-matches |
Number of EDNS Ping matches. |
ednsPingMatches (70) |
edns-ping-mismatches |
Number of EDNS Ping mismatches. |
ednsPingMismatches (71) |
empty-queries |
Number of queries dropped because they had a QD count of 0. |
emptyQueries (94) |
failed-host-entries |
Number of entries in the failed NS cache. |
failedHostEntries (52) |
fd-usage |
File descriptors usage. |
fdUsage (77) |
idle-tcpout-connections |
Number of connections in the TCP idle outgoing connections pool. |
|
ignored-packets |
Number of ignored packets. |
ignoredPackets (47) |
ipv6-outqueries |
Number of IPv6 outgoing queries sent. |
ipv6Outqueries (60) |
ipv6-questions |
Number of IPv6 questions. Counts all end-user initiated queries with the RD bit set, received over IPv6 UDP. |
ipv6Questions (2) |
maintenance-calls |
Number of times internal maintenance has been called, including Lua maintenance. |
maintenanceCalls (128) |
maintenance-usec |
Time spent doing internal maintenance, including Lua maintenance. |
maintenanceUsec (127) |
malloc-bytes |
Number of bytes allocated by malloc. Broken, always returns 0. |
mallocBytes (12) |
max-cache-entries |
Currently configured maximum number of cache entries. |
|
max-chain-length |
Maximum chain length. |
maxChainLength (149) |
max-chain-weight |
Maximum chain weight. |
maxChainWeight (150) |
max-mthread-stack |
Maximum amount of the mthread stack ever used. |
maxMthreadStack (48) |
max-packetcache-entries |
Currently configured maximum number of packet cache entries. |
|
memory-alloc-flux |
Only relevant for development and if malloc tracing is enabled. |
|
memory-allocated |
Only relevant for development and if malloc tracing is enabled. |
|
memory-allocs |
Only relevant for development and if malloc tracing is enabled. |
|
negcache-entries |
Number of negcache entries. |
negcacheEntries (49) |
no-packet-error |
Number of calls to recvmsg() that returned no packet even though the socket was ready. |
noPacketError (45) |
nod-events |
Count of NOD events. |
nodEvents (147) |
nod-lookups-dropped-oversize |
Number of NOD lookups dropped because they would exceed the maximum name length. |
nodLookupsDroppedOversize (104) |
noedns-outqueries |
Number of outgoing queries without EDNS. |
noednsOutqueries (74) |
noerror-answers |
Number of noerror answers. |
noerrorAnswers (15) |
non-resolving-nameserver-entries |
Number of entries in the non-resolving NS name cache. |
nonResolvingNameserverEntries (126) |
noping-outqueries |
Number of outgoing queries without ping. |
nopingOutqueries (73) |
nsset-invalidations |
Number of nsset invalidations. |
nssetInvalidations (41) |
nsspeeds-entries |
Number of nsspeeds entries. |
nsspeedsEntries (51) |
nxdomain-answers |
Number of nxdomain answers. |
nxdomainAnswers (14) |
outgoing-timeouts |
Number of outgoing timeouts. |
outgoingTimeouts (55) |
outgoing4-timeouts |
Number of IPv4 outgoing timeouts. |
outgoing4Timeouts (56) |
outgoing6-timeouts |
Number of IPv6 outgoing timeouts. |
outgoing6Timeouts (57) |
over-capacity-drops |
Number of queries dropped because the threads limit was reached. |
overCapacityDrops (43) |
packetcache-acquired |
Number of packet cache lock acquisitions. |
packetcacheAcquired (146) |
packetcache-bytes |
Size of the packetcache in bytes. Disabled by default, see recursor.stats_rec_control_disabled_list. This metric is currently broken, it always is 0. |
packetcacheBytes (11) |
packetcache-contended |
Number of contended packet cache lock acquisitions. |
packetcacheContended (145) |
packetcache-entries |
Number of packetcache entries. |
packetcacheEntries (10) |
packetcache-hits |
Number of packetcache hits. |
packetcacheHits (8) |
packetcache-misses |
Number of packetcache misses. |
packetcacheMisses (9) |
policy-drops |
Number of queries dropped because of a policy. |
policyDrops (44) |
policy-hits |
Number of policy decisions based on Lua. (type = "filter" ), or RPZ (type = "rpz" ). RPZ hits include the policyName. These metrics are useful for Prometheus and not listed in other outputs by default. |
|
policy-result-custom |
Number of policy-mandated custom results. |
policyResultCustom (91) |
policy-result-drop |
Number of policy-mandated drops. |
policyResultDrop (87) |
policy-result-noaction |
Number of policy-mandated no-action results. |
policyResultNoaction (86) |
policy-result-nodata |
Number of policy-mandated nodata results. |
policyResultNodata (89) |
policy-result-nxdomain |
Number of policy-mandated NXdomain results. |
policyResultNxdomain (88) |
policy-result-truncate |
Number of policy-mandated truncate results. |
policyResultTruncate (90) |
proxy-mapping |
Proxy mappings done. |
|
proxy-protocol-invalid |
Number of invalid proxy protocol headers received. |
proxyProtocolInvalid (101) |
qa-latency |
Shows the current latency average, in microseconds, exponentially weighted over past ‘latency-statistic-size’ packets. |
qaLatency (37) |
qname-min-fallback-success |
Number of successful queries due to fallback mechanism within ‘qname-minimization’ setting. |
qnameMinFallbackSuccess (100) |
query-pipe-full-drops |
Number of queries dropped because the query distribution pipe was full. |
queryPipeFullDrops (92) |
questions |
Number of questions. Counts all end-user initiated queries with the RD bit set. |
questions (1) |
real-memory-usage |
Memory usage. |
realMemoryUsage (76) |
rebalanced-queries |
Number of queries re-distributed because the first selected worker thread was above the target load. |
rebalancedQueries (99) |
record-cache-acquired |
Number of record cache lock acquisitions. |
recordCacheAcquired (103) |
record-cache-contended |
Number of contended record cache lock acquisitions. |
recordCacheContended (102) |
remote-logger-count |
Number of remote logging events. |
|
resource-limits |
Number of resolution aborted because of a local resource limit. |
resourceLimits (42) |
security-status |
Current security status. |
securityStatus (54) |
server-parse-errors |
Number of server parse errors. |
serverParseErrors (20) |
servfail-answers |
Number of servfail answers. |
servfailAnswers (13) |
source-disallowed-notify |
Number of NOTIFY operations not allowed by allow-notify-from. |
sourceDisallowedNotify (124) |
special-memory-usage |
Memory usage (more precise but expensive to retrieve). |
specialMemoryUsage (98) |
spoof-prevents |
Number of spoof prevents. |
spoofPrevents (40) |
sys-msec |
CPU usage (system) in ms. |
sysMsec (79) |
taskqueue-expired |
Number of tasks expired before they could be run. |
taskqueueExpired (106) |
taskqueue-pushed |
Number of tasks pushed to the taskqueues. |
taskqueuePushed (105) |
taskqueue-size |
Number of tasks currently in the taskqueues. |
taskqueueSize (107) |
tcp-client-overflow |
Number of TCP client connections refused because of too many connections. |
tcpClientOverflow (18) |
tcp-clients |
Number of TCP clients. |
tcpClients (65) |
tcp-outqueries |
Number of outgoing TCP queries sent. |
tcpOutqueries (58) |
tcp-overflow |
Incoming TCP limits reached. |
tcpOverflow (152) |
tcp-questions |
Number of TCP questions. |
tcpQuestions (3) |
throttle-entries |
Number of throttle entries. |
throttleEntries (50) |
throttled-out |
Number of throttled outgoing queries. |
|
throttled-outqueries |
Number of throttled outgoing queries. |
throttledOutqueries (61) |
too-old-drops |
Number of queries dropped because of a timeout. |
tooOldDrops (21) |
truncated-drops |
Number of queries dropped because they were larger than 512 bytes. |
truncatedDrops (93) |
udp-in-csum-errors |
Number of UDP in checksum errors (Linux only). |
udpInCsumErrors (118) |
udp-in-errors |
Number of UDP in errors (Linux only). |
udpInErrors (69) |
udp-noport-errors |
Number of UDP noport errors (Linux only). |
udpNoportErrors (68) |
udp-recvbuf-errors |
Number of UDP recvbuf errors (Linux only). |
udpRecvbufErrors (66) |
udp-sndbuf-errors |
Number of UDP sndbuf errors (Linux only). |
udpSndbufErrors (67) |
udp6-in-csum-errors |
Number of UDP6 in checksum errors (Linux only). |
udp6InCsumErrors (123) |
udp6-in-errors |
Number of UDP6 in errors (Linux only). |
udp6InErrors (122) |
udp6-noport-errors |
Number of UDP6 noport errors (Linux only). |
udp6NoportErrors (121) |
udp6-recvbuf-errors |
Number of UDP6 recvbuf errors (Linux only). |
udp6RecvbufErrors (119) |
udp6-sndbuf-errors |
Number of UDP6 sndbuf errors (Linux only). |
udp6SndbufErrors (120) |
udr-events |
Count of UDR events. |
udrEvents (148) |
unauthorized-tcp |
Number of unauthorized TCP queries. |
unauthorizedTcp (17) |
unauthorized-udp |
Number of unauthorized UDP queries. |
unauthorizedUdp (16) |
unexpected-packets |
Number of unexpected packets. |
unexpectedPackets (38) |
unreachables |
Number of errors due to an unreachable server. |
unreachables (63) |
uptime |
Process uptime in seconds. |
uptime (75) |
user-msec |
CPU usage (user) in ms. |
userMsec (78) |
variable-responses |
Number of variable responses. |
variableResponses (97) |
x-dnssec-result-bogus |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-invalid-denial |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-invalid-dnskey-protocol |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-missing-negative-indication |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-no-rrsig |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-no-valid-dnskey |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-no-valid-rrsig |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-no-zone-key-bit-set |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-revoked-dnskey |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-self-signed-ds |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-signature-expired |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-signature-not-yet-valid |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-unable-to-get-dnskeys |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-unable-to-get-dss |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-unsupported-dnskey-algo |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-bogus-unsupported-ds-digest-type |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-indeterminate |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-insecure |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-nta |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-dnssec-result-secure |
Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names. |
|
x-our-latency |
Shows the averaged time spent within PowerDNS, in microseconds, exponentially weighted over past ‘latency-statistic-size’ packets. |
|
x-ourtime-slow |
Counts responses where more than 32 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
x-ourtime0-1 |
Counts responses where between 0 and 1 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
x-ourtime1-2 |
Counts responses where between 1 and 2 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
x-ourtime16-32 |
Counts responses where between 16 and 32 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
x-ourtime2-4 |
Counts responses where between 16 and 32 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
x-ourtime4-8 |
Counts responses where between 4 and 8 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
x-ourtime8-16 |
Counts responses where between 8 and 16 milliseconds was spent within the Recursor. Not yet proven to be reliable. |
|
zone-disallowed-notify |
Number of NOTIFY operations not allowed by allow-notify-for. |
zoneDisallowedNotify (125) |