SCOM; DNS2016 and above Management Pack (Performance Collections)

Question

i have a question about the performance collections in the DNS management pack:

Rule: Windows DNS Server 2016 and 1709+ Number of Queries Performance Collection Rule
Counter: QueriesReceived

this collection-rule shows us the the number of DNS queries for a specific DNS-zone during an intervall (Default: 900 seconds)

in our environment the performance-counter is growing continuously. but for my understanding, the counter should stay stable on a average value after some days, because the amount of received queries should not growing anymore?

or what is the purpose of this performance collection? otherwise, the counter would increase to infinity?

Answer 1

Behind the scene, that rule uses the following powershell code to collect QueriesReceived counter :

                $allStatistics = Get-DnsServerStatistics -ZoneName $zone.ZoneName -ComputerName $PrincipalName -ErrorAction Stop  
				[double]$QueriesReceived = 0  
				[double]$QueriesFailure = 0  
				[double]$QueriesNameError = 0  
				$zoneQueryStatistics = @()  
				$zoneQueryStatistics += $allStatistics.ZoneQueryStatistics  
				if ($zoneQueryStatistics -ne $null -and $zoneQueryStatistics.Count -gt 0)  
				{  
					foreach ($zoneQueryStat in $zoneQueryStatistics)  
					{  
						$QueriesReceived += $zoneQueryStat.QueriesReceived  
						$QueriesNameError += $zoneQueryStat.QueriesNameError  
						$QueriesFailure += $zoneQueryStat.QueriesFailure  
					}  
				}  
				$bag = $momAPI.CreatePropertyBag()  
				$bag.AddValue("ServerName", $PrincipalName)  
				$bag.AddValue("ZoneName", $zone.ZoneName)  
				$bag.AddValue("QueriesReceived", $QueriesReceived)  
				$bag.AddValue("QueriesNameError", $QueriesNameError)  
				$bag.AddValue("QueriesFailure", $QueriesFailure)  
				$bag  

And the documentation for Get-DnsServerStatistics cmdlet does indeed show that it returns the number of QueriesReceived "since last cleared statistics", which basically is last server restart unless someone manually cleared those statistics.
I would consider that counter rather useless in its current form, it would be more interesting if it had been authored using a Delta performance data provider (which would return the increase since last measurement instead of the raw value)

Answer 2

many thanks for this input! you are absolutely right! if the DNS-server is rebooted oder just manually clearing the stats with the ps-commandlet, the scom-performance-rule-data is also cleared :-)
there is indeed another monitor in the management-pack who is checking a delta value -> monitor-name: "Windows DNS Server 2016 and 1709+ Detect Server Query Overload"

summary-description of the monitor:
This monitor evaluates the delta value between number received queries in specified interval of Windows Server 2016 and 1709+ DNS Server. If the delta value is greater than Warning threshold but less or equal than Critical threshold the monitor changes state to Warning and generate an alert with Warning severity. If the delta value greater than Critical threshold the monitor changes state to Critical and generates an alert with Critical severity