Home
  •  

Windows DNS Server 2016 and 1709+ Detect Server Query Overload

Microsoft.Windows.DNSServer.2016.Monitor.DetectServerQueryOverload (UnitMonitor)

This monitor detects the overloaded DNS Server. If a DNS Server sees a lot of queries in a given timeframe than a configured threshold, then this monitor will turn red.

Knowledge Base article:

Summary

This monitor evaluates the delta value between number received queries in specified interval of Windows Server 2016 and 1709+ DNS Server. If the delta value is greater than Warning threshold but less or equal than Critical threshold the monitor changes state to Warning and generate an alert with Warning severity. If the delta value greater than Critical threshold the monitor changes state to Critical and generates an alert with Critical severity.

Configuration

Queries Received Delta Warning Threshold: The threshold for warning state.

Queries Received Delta Critical Threshold: The threshold for critical state.

Interval Seconds: The number of seconds between values for a delta evaluation.

Sync Time: Specifies the time at which the Windows script is forced to run.

Timeout Seconds: Specifies the maximum number of seconds to allow the script to execute before the script is terminated.

Causes

The Server is receiving too much queries.

Resolutions

Reduce the using Server.

Element properties:

TargetMicrosoft.Windows.DNSServer.2016.Server
Parent MonitorSystem.Health.PerformanceState
CategoryPerformanceHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.DNSServer.2016.DetectServerQueryOverload.UnitMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Windows DNS 2016 and 1709+ - Server Query Overload
Current value of queries per last interval is {0}
RunAsMicrosoft.Windows.DNSServer.2016.ActionAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.DNSServer.2016.Monitor.DetectServerQueryOverload" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.DNSServer.2016.Server" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Microsoft.Windows.DNSServer.2016.DetectServerQueryOverload.UnitMonitorType" ConfirmDelivery="true" RunAs="Microsoft.Windows.DNSServer.2016.ActionAccount">

  <Category>PerformanceHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.DNSServer.2016.Monitor.DetectServerQueryOverload_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data[Default='']/Context/Value$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Critical" MonitorTypeStateID="Critical" HealthState="Error"/>

    <OperationalState ID="Warning" MonitorTypeStateID="Warning" HealthState="Warning"/>

    <OperationalState ID="Healthy" MonitorTypeStateID="Healthy" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>

    <QPS_THRESHOLD_YELLOW>30000</QPS_THRESHOLD_YELLOW>

    <QPS_THRESHOLD_RED>50000</QPS_THRESHOLD_RED>

    <IntervalSeconds>300</IntervalSeconds>

    <SyncTime/>

    <TimeoutSeconds>240</TimeoutSeconds>

  </Configuration>

</UnitMonitor>