Metrics
rec_control name Description SNMP Object and OID
aggressive-nsec-cache-entries Number of entries in the aggressive NSEC cache. aggressiveNSECCacheEntries (108)
aggressive-nsec-cache-nsec-hits Number of NSEC-related hits from the aggressive NSEC cache. aggressiveNSECCacheNSECHits (109)
aggressive-nsec-cache-nsec-wc-hits Number of answers synthesized from the NSEC aggressive cache. aggressiveNSECCacheNSECWcHits (111)
aggressive-nsec-cache-nsec3-hits Number of NSEC3-related hits from the aggressive NSEC cache. aggressiveNSECCacheNSEC3Hits (110)
aggressive-nsec-cache-nsec3-wc-hits Number of answers synthesized from the NSEC3 aggressive cache. aggressiveNSECCacheNSEC3WcHits (112)
all-outqueries Number of outgoing queries. allOutqueries (59)
almost-expired-exceptions Number of almost-expired tasks that caused an exception. almostExpiredExceptions (117)
almost-expired-pushed Number of almost-expired tasks pushed. almostExpiredPushed (115)
almost-expired-run Number of almost-expired tasks run to completion. almostExpiredRun (116)
answers-slow Number of queries answered in more than 1000 ms. answersSlow (26)
answers0-1 Number of queries answered in less than 1 ms. answers01 (22)
answers1-10 Number of queries answered in 1-10 ms. answers110 (23)
answers10-100 Number of queries answered in 10-100 ms. answers10100 (24)
answers100-1000 Number of queries answered in 100-1000 ms. answers1001000 (25)
auth-formerr-answers Number of rcode 1 (formerr) answers received. authFormerrAnswers (130)
auth-noerror-answers Number of rcode 0 (noerror) answers received. authNoerrorAnswers (129)
auth-notauth-answers Number of rcode 9 (notauth) answers received. authNotauthAnswers (138)
auth-notimp-answers Number of rcode 4 (notimp) answers received. authNotimpAnswers (133)
auth-nxdomain-answers Number of rcode 3 (nxdomain) answers received. authNxdomainAnswers (132)
auth-nxrrset-answers Number of rcode 8 (nxrrset) answers received. authNxrrsetAnswers (137)
auth-rcode10-answers Number of rcode 10 answers received. authRcode10Answers (139)
auth-rcode11-answers Number of rcode 11 answers received. authRcode11Answers (140)
auth-rcode12-answers Number of rcode 12 answers received. authRcode12Answers (141)
auth-rcode13-answers Number of rcode 13 answers received. authRcode13Answers (142)
auth-rcode14-answers Number of rcode 14 answers received. authRcode14Answers (143)
auth-rcode15-answers Number of rcode 15 answers received. authRcode15Answers (144)
auth-refused-answers Number of rcode 5 (refused) answers received. authRefusedAnswers (134)
auth-servfail-answers Number of rcode 2 (servfail) answers received. authServfailAnswers (131)
auth-yxdomain-answers Number of rcode 6 (yxdomain) answers received. authYxdomainAnswers (135)
auth-yxrrset-answers Number of rcode 7 (yxrrset) answers received. authYxrrsetAnswers (136)
auth-zone-queries Number of queries to locally hosted authoritative zones (‘setting-auth-zones’).  
auth4-answers-slow Number of IPv4 queries answered in more than 1000 ms. auth4AnswersSlow (31)
auth4-answers0-1 Number of IPv4 queries answered in less than 1 ms. auth4Answers01 (27)
auth4-answers1-10 Number of IPv4 queries answered in 1-10 ms. auth4Answers110 (28)
auth4-answers10-100 Number of IPv4 queries answered in 10-100 ms. auth4Answers10100 (29)
auth4-answers100-1000 Number of IPv4 queries answered in 100-1000 ms. auth4Answers1001000 (30)
auth6-answers-slow Number of IPv6 queries answered in more than 1000 ms. auth6AnswersSlow (36)
auth6-answers0-1 Number of IPv6 queries answered in less than 1 ms. auth6Answers01 (32)
auth6-answers1-10 Number of IPv6 queries answered in 1-10 ms. auth6Answers110 (33)
auth6-answers10-100 Number of IPv6 queries answered in 10-100 ms. auth6Answers10100 (34)
auth6-answers100-1000 Number of IPv6 queries answered in 100-1000 ms. auth6Answers1001000 (35)
cache-bytes Size of the cache in bytes. Since version 5.3.0 this metric computes a rough estimate of the number of bytes allocated by the record cache. Older versions return a number that cannot be relied upon. Disabled by default, as computing this number is CPU intensive, see recursor.stats_rec_control_disabled_list. cacheBytes (7)
cache-entries Number of record cache entries. cacheEntries (6)
cache-hits Number of cache hits. This does not include hits that got answered from the packet-cache. cacheHits (4)
cache-misses Number of cache misses. This does not include hits that got answered from the packet-cache. cacheMisses (5)
case-mismatches Number of case mismatches. caseMismatches (39)
chain-limits Chain limits reached. chainLimits (151)
chain-resends Number of chain resends. chainResends (64)
client-parse-errors Number of client parse errors. clientParseErrors (19)
concurrent-queries Number of concurrent queries. concurrentQueries (53)
cpu-iowait Time spent waiting for I/O to complete by the whole system, in units of USER_HZ.  
cpu-msec-thread-n Number of milliseconds spent in thread n.  
cpu-steal Stolen time, which is the time spent by the whole system in other operating systems when running in a virtualized environment, in units of USER_HZ.  
cumul-authanswers-x Cumulative counts of answer times to clients in buckets less than x microseconds. Disabled by default, see recursor.stats_rec_control_disabled_list. These metrics are useful for Prometheus and not listed in other outputs by default.  
cumul-clientanswers-x Cumulative counts of answer times of authoritative servers in buckets less than x microseconds. Disabled by default, see recursor.stats_rec_control_disabled_list. These metrics are useful for Prometheus and not listed in other outputs by default.  
dlg-only-drops Obsolete. dlgOnlyDrops (46)
dns64-prefix-answers Number of answers generated by dns64-prefix matching. dns64PrefixAnswers (114)
dnssec-authentic-data-queries Number of queries received with the AD bit set. dnssecAuthenticDataQueries (95)
dnssec-check-disabled-queries Number of queries received with the CD bit set. dnssecCheckDisabledQueries (96)
dnssec-queries Number of DNSSEC queries. dnssecQueries (72)
dnssec-result-bogus Number of responses sent, excluding packet-cache hits, that were in the DNSSEC bogus state. dnssecResultBogus (83)
dnssec-result-bogus-invalid-denial Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid denial of existence proof could not be found.  
dnssec-result-bogus-invalid-dnskey-protocol Number of responses sent, packet-cache hits excluded, that were in the Bogus state because all DNSKEYs had invalid protocols.  
dnssec-result-bogus-missing-negative-indication Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a NODATA or NXDOMAIN answer lacked the required SOA and/or NSEC(3) records.  
dnssec-result-bogus-no-rrsig Number of responses sent, packet-cache hits excluded, that were in the Bogus state because required RRSIG records were not present in an answer.  
dnssec-result-bogus-no-valid-dnskey Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid DNSKEY could not be found.  
dnssec-result-bogus-no-valid-rrsig Number of responses sent, packet-cache hits excluded, that were in the Bogus state because only invalid RRSIG records were present in an answer.  
dnssec-result-bogus-no-zone-key-bit-set Number of responses sent, packet-cache hits excluded, that were in the Bogus state because no DNSKEY with the Zone Key bit set was found.  
dnssec-result-bogus-revoked-dnskey Number of responses sent, packet-cache hits excluded, that were in the Bogus state because all DNSKEYs were revoked.  
dnssec-result-bogus-self-signed-ds Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a DS record was signed by itself.  
dnssec-result-bogus-signature-expired Number of responses sent, packet-cache hits excluded, that were in the Bogus state because the signature expired time in the RRSIG was in the past.  
dnssec-result-bogus-signature-not-yet-valid Number of responses sent, packet-cache hits excluded, that were in the Bogus state because the signature inception time in the RRSIG was not yet valid.  
dnssec-result-bogus-unable-to-get-dnskeys Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid DNSKEY could not be retrieved.  
dnssec-result-bogus-unable-to-get-dss Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a valid DS could not be retrieved.  
dnssec-result-bogus-unsupported-dnskey-algo Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a DNSKEY RRset contained only unsupported DNSSEC algorithms.  
dnssec-result-bogus-unsupported-ds-digest-type Number of responses sent, packet-cache hits excluded, that were in the Bogus state because a DS RRset contained only unsupported digest types.  
dnssec-result-indeterminate Number of responses sent, excluding packet-cache hits, that were in the DNSSEC indeterminate state. dnssecResultIndeterminate (84)
dnssec-result-insecure Number of responses sent, excluding packet-cache hits, that were in the DNSSEC insecure state. dnssecResultInsecure (81)
dnssec-result-nta Number of responses sent, excluding packet-cache hits, that were in the DNSSEC NTA state. dnssecResultNta (85)
dnssec-result-secure Number of responses sent, excluding packet-cache hits, that were in the DNSSEC secure state. dnssecResultSecure (82)
dnssec-validations Number of responses sent, packet-cache hits excluded, for which a DNSSEC validation was requested by either the client or the configuration. dnssecValidations (80)
dont-outqueries Number of outgoing queries not sent because of a ‘dont-query’ setting. dontOutqueries (62)
dot-outqueries Number of outgoing DoT queries. dotOutqueries (113)
ecs-queries Number of outgoing queries adorned with an EDNS Client Subnet option.  
ecs-responses Number of responses received from authoritative servers with an EDNS Client Subnet option we used.  
edns-ping-matches Number of EDNS Ping matches. ednsPingMatches (70)
edns-ping-mismatches Number of EDNS Ping mismatches. ednsPingMismatches (71)
empty-queries Number of queries dropped because they had a QD count of 0. emptyQueries (94)
failed-host-entries Number of entries in the failed NS cache. failedHostEntries (52)
fd-usage File descriptors usage. fdUsage (77)
idle-tcpout-connections Number of connections in the TCP idle outgoing connections pool.  
ignored-packets Number of ignored packets. ignoredPackets (47)
ipv6-outqueries Number of IPv6 outgoing queries sent. ipv6Outqueries (60)
ipv6-questions Number of IPv6 questions. Counts all end-user initiated queries with the RD bit set, received over IPv6 UDP. ipv6Questions (2)
maintenance-calls Number of times internal maintenance has been called, including Lua maintenance. maintenanceCalls (128)
maintenance-usec Time spent doing internal maintenance, including Lua maintenance. maintenanceUsec (127)
malloc-bytes Number of bytes allocated by malloc. Broken, always returns 0. mallocBytes (12)
max-cache-entries Currently configured maximum number of cache entries.  
max-chain-length Maximum chain length. maxChainLength (149)
max-chain-weight Maximum chain weight. maxChainWeight (150)
max-mthread-stack Maximum amount of the mthread stack ever used. maxMthreadStack (48)
max-packetcache-entries Currently configured maximum number of packet cache entries.  
memory-alloc-flux Only relevant for development and if malloc tracing is enabled.  
memory-allocated Only relevant for development and if malloc tracing is enabled.  
memory-allocs Only relevant for development and if malloc tracing is enabled.  
negcache-entries Number of negcache entries. negcacheEntries (49)
no-packet-error Number of calls to recvmsg() that returned no packet even though the socket was ready. noPacketError (45)
nod-events Count of NOD events. nodEvents (147)
nod-lookups-dropped-oversize Number of NOD lookups dropped because they would exceed the maximum name length. nodLookupsDroppedOversize (104)
noedns-outqueries Number of outgoing queries without EDNS. noednsOutqueries (74)
noerror-answers Number of noerror answers. noerrorAnswers (15)
non-resolving-nameserver-entries Number of entries in the non-resolving NS name cache. nonResolvingNameserverEntries (126)
noping-outqueries Number of outgoing queries without ping. nopingOutqueries (73)
nsset-invalidations Number of nsset invalidations. nssetInvalidations (41)
nsspeeds-entries Number of nsspeeds entries. nsspeedsEntries (51)
nxdomain-answers Number of nxdomain answers. nxdomainAnswers (14)
outgoing-timeouts Number of outgoing timeouts. outgoingTimeouts (55)
outgoing4-timeouts Number of IPv4 outgoing timeouts. outgoing4Timeouts (56)
outgoing6-timeouts Number of IPv6 outgoing timeouts. outgoing6Timeouts (57)
over-capacity-drops Number of queries dropped because the threads limit was reached. overCapacityDrops (43)
packetcache-acquired Number of packet cache lock acquisitions. packetcacheAcquired (146)
packetcache-bytes Size of the packetcache in bytes. Disabled by default, see recursor.stats_rec_control_disabled_list. This metric is currently broken, it always is 0. packetcacheBytes (11)
packetcache-contended Number of contended packet cache lock acquisitions. packetcacheContended (145)
packetcache-entries Number of packetcache entries. packetcacheEntries (10)
packetcache-hits Number of packetcache hits. packetcacheHits (8)
packetcache-misses Number of packetcache misses. packetcacheMisses (9)
policy-drops Number of queries dropped because of a policy. policyDrops (44)
policy-hits Number of policy decisions based on Lua. (type = "filter"), or RPZ (type = "rpz"). RPZ hits include the policyName. These metrics are useful for Prometheus and not listed in other outputs by default.  
policy-result-custom Number of policy-mandated custom results. policyResultCustom (91)
policy-result-drop Number of policy-mandated drops. policyResultDrop (87)
policy-result-noaction Number of policy-mandated no-action results. policyResultNoaction (86)
policy-result-nodata Number of policy-mandated nodata results. policyResultNodata (89)
policy-result-nxdomain Number of policy-mandated NXdomain results. policyResultNxdomain (88)
policy-result-truncate Number of policy-mandated truncate results. policyResultTruncate (90)
proxy-mapping Proxy mappings done.  
proxy-protocol-invalid Number of invalid proxy protocol headers received. proxyProtocolInvalid (101)
qa-latency Shows the current latency average, in microseconds, exponentially weighted over past ‘latency-statistic-size’ packets. qaLatency (37)
qname-min-fallback-success Number of successful queries due to fallback mechanism within ‘qname-minimization’ setting. qnameMinFallbackSuccess (100)
query-pipe-full-drops Number of queries dropped because the query distribution pipe was full. queryPipeFullDrops (92)
questions Number of questions. Counts all end-user initiated queries with the RD bit set. questions (1)
real-memory-usage Memory usage. realMemoryUsage (76)
rebalanced-queries Number of queries re-distributed because the first selected worker thread was above the target load. rebalancedQueries (99)
record-cache-acquired Number of record cache lock acquisitions. recordCacheAcquired (103)
record-cache-contended Number of contended record cache lock acquisitions. recordCacheContended (102)
remote-logger-count Number of remote logging events.  
resource-limits Number of resolution aborted because of a local resource limit. resourceLimits (42)
security-status Current security status. securityStatus (54)
server-parse-errors Number of server parse errors. serverParseErrors (20)
servfail-answers Number of servfail answers. servfailAnswers (13)
source-disallowed-notify Number of NOTIFY operations not allowed by allow-notify-from. sourceDisallowedNotify (124)
special-memory-usage Memory usage (more precise but expensive to retrieve). specialMemoryUsage (98)
spoof-prevents Number of spoof prevents. spoofPrevents (40)
sys-msec CPU usage (system) in ms. sysMsec (79)
taskqueue-expired Number of tasks expired before they could be run. taskqueueExpired (106)
taskqueue-pushed Number of tasks pushed to the taskqueues. taskqueuePushed (105)
taskqueue-size Number of tasks currently in the taskqueues. taskqueueSize (107)
tcp-client-overflow Number of TCP client connections refused because of too many connections. tcpClientOverflow (18)
tcp-clients Number of TCP clients. tcpClients (65)
tcp-outqueries Number of outgoing TCP queries sent. tcpOutqueries (58)
tcp-overflow Incoming TCP limits reached. tcpOverflow (152)
tcp-questions Number of TCP questions. tcpQuestions (3)
throttle-entries Number of throttle entries. throttleEntries (50)
throttled-out Number of throttled outgoing queries.  
throttled-outqueries Number of throttled outgoing queries. throttledOutqueries (61)
too-old-drops Number of queries dropped because of a timeout. tooOldDrops (21)
truncated-drops Number of queries dropped because they were larger than 512 bytes. truncatedDrops (93)
udp-in-csum-errors Number of UDP in checksum errors (Linux only). udpInCsumErrors (118)
udp-in-errors Number of UDP in errors (Linux only). udpInErrors (69)
udp-noport-errors Number of UDP noport errors (Linux only). udpNoportErrors (68)
udp-recvbuf-errors Number of UDP recvbuf errors (Linux only). udpRecvbufErrors (66)
udp-sndbuf-errors Number of UDP sndbuf errors (Linux only). udpSndbufErrors (67)
udp6-in-csum-errors Number of UDP6 in checksum errors (Linux only). udp6InCsumErrors (123)
udp6-in-errors Number of UDP6 in errors (Linux only). udp6InErrors (122)
udp6-noport-errors Number of UDP6 noport errors (Linux only). udp6NoportErrors (121)
udp6-recvbuf-errors Number of UDP6 recvbuf errors (Linux only). udp6RecvbufErrors (119)
udp6-sndbuf-errors Number of UDP6 sndbuf errors (Linux only). udp6SndbufErrors (120)
udr-events Count of UDR events. udrEvents (148)
unauthorized-tcp Number of unauthorized TCP queries. unauthorizedTcp (17)
unauthorized-udp Number of unauthorized UDP queries. unauthorizedUdp (16)
unexpected-packets Number of unexpected packets. unexpectedPackets (38)
unreachables Number of errors due to an unreachable server. unreachables (63)
uptime Process uptime in seconds. uptime (75)
user-msec CPU usage (user) in ms. userMsec (78)
variable-responses Number of variable responses. variableResponses (97)
x-dnssec-result-bogus Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-invalid-denial Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-invalid-dnskey-protocol Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-missing-negative-indication Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-no-rrsig Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-no-valid-dnskey Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-no-valid-rrsig Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-no-zone-key-bit-set Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-revoked-dnskey Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-self-signed-ds Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-signature-expired Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-signature-not-yet-valid Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-unable-to-get-dnskeys Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-unable-to-get-dss Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-unsupported-dnskey-algo Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-bogus-unsupported-ds-digest-type Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-indeterminate Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-insecure Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-nta Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-dnssec-result-secure Same as corresponding metric without x- prefix, for names in dnssec.x_dnssec_names.  
x-our-latency Shows the averaged time spent within PowerDNS, in microseconds, exponentially weighted over past ‘latency-statistic-size’ packets.  
x-ourtime-slow Counts responses where more than 32 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
x-ourtime0-1 Counts responses where between 0 and 1 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
x-ourtime1-2 Counts responses where between 1 and 2 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
x-ourtime16-32 Counts responses where between 16 and 32 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
x-ourtime2-4 Counts responses where between 16 and 32 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
x-ourtime4-8 Counts responses where between 4 and 8 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
x-ourtime8-16 Counts responses where between 8 and 16 milliseconds was spent within the Recursor. Not yet proven to be reliable.  
zone-disallowed-notify Number of NOTIFY operations not allowed by allow-notify-for. zoneDisallowedNotify (125)