SCOM; DNS2016 and above Management Pack (Performance Collections)

Sandro D'Incà 226 Reputation points
2022-11-14T13:17:43.797+00:00

i have a question about the performance collections in the DNS management pack:

Rule: Windows DNS Server 2016 and 1709+ Number of Queries Performance Collection Rule
Counter: QueriesReceived

this collection-rule shows us the the number of DNS queries for a specific DNS-zone during an intervall (Default: 900 seconds)

in our environment the performance-counter is growing continuously. but for my understanding, the counter should stay stable on a average value after some days, because the amount of received queries should not growing anymore?

or what is the purpose of this performance collection? otherwise, the counter would increase to infinity?

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,443 questions
0 comments No comments
{count} votes

Accepted answer
  1. CyrAz 5,181 Reputation points
    2022-11-14T14:06:34.19+00:00

    Behind the scene, that rule uses the following powershell code to collect QueriesReceived counter :

                    $allStatistics = Get-DnsServerStatistics -ZoneName $zone.ZoneName -ComputerName $PrincipalName -ErrorAction Stop  
    				[double]$QueriesReceived = 0  
    				[double]$QueriesFailure = 0  
    				[double]$QueriesNameError = 0  
    				$zoneQueryStatistics = @()  
    				$zoneQueryStatistics += $allStatistics.ZoneQueryStatistics  
    				if ($zoneQueryStatistics -ne $null -and $zoneQueryStatistics.Count -gt 0)  
    				{  
    					foreach ($zoneQueryStat in $zoneQueryStatistics)  
    					{  
    						$QueriesReceived += $zoneQueryStat.QueriesReceived  
    						$QueriesNameError += $zoneQueryStat.QueriesNameError  
    						$QueriesFailure += $zoneQueryStat.QueriesFailure  
    					}  
    				}  
    				$bag = $momAPI.CreatePropertyBag()  
    				$bag.AddValue("ServerName", $PrincipalName)  
    				$bag.AddValue("ZoneName", $zone.ZoneName)  
    				$bag.AddValue("QueriesReceived", $QueriesReceived)  
    				$bag.AddValue("QueriesNameError", $QueriesNameError)  
    				$bag.AddValue("QueriesFailure", $QueriesFailure)  
    				$bag  
    

    And the documentation for Get-DnsServerStatistics cmdlet does indeed show that it returns the number of QueriesReceived "since last cleared statistics", which basically is last server restart unless someone manually cleared those statistics.
    I would consider that counter rather useless in its current form, it would be more interesting if it had been authored using a Delta performance data provider (which would return the increase since last measurement instead of the raw value)

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Sandro D'Incà 226 Reputation points
    2022-11-16T13:19:35.737+00:00

    many thanks for this input! you are absolutely right! if the DNS-server is rebooted oder just manually clearing the stats with the ps-commandlet, the scom-performance-rule-data is also cleared :-)
    there is indeed another monitor in the management-pack who is checking a delta value -> monitor-name: "Windows DNS Server 2016 and 1709+ Detect Server Query Overload"

    summary-description of the monitor:
    This monitor evaluates the delta value between number received queries in specified interval of Windows Server 2016 and 1709+ DNS Server. If the delta value is greater than Warning threshold but less or equal than Critical threshold the monitor changes state to Warning and generate an alert with Warning severity. If the delta value greater than Critical threshold the monitor changes state to Critical and generates an alert with Critical severity

    0 comments No comments