Skip to main content
DNS → Analytics shows what a server answered over a span: how many queries, where the answers came from, how long they took, and who asked what. It reads counts kept for this, never the query log’s files, so opening it costs the server next to nothing.

What it shows

Pick a span of 1 hour, 6 hours, 24 hours, 7 days or 30 days, and optionally a division, a zone or another server of a cluster.
  • Totals and over time: queries, queries per second, answered from zones, from the cache, forwarded upstream and blocked by filtering, NXDOMAIN, SERVFAIL and other response codes, average and p50/p95 response time.
  • How queries split: by kind of answer, query type, protocol (UDP, TCP, DoT, DoH, DoQ) and response code.
  • Top lists: domains, blocked domains, clients and zones, a page at a time; countries when GeoDNS’ country database is there; upstreams with their latency.
Click a domain or client to open it in Query logs with that filter. The antenna beside it, or a right click, opens it in Live capture. Clicking a zone filters the page. The page refreshes itself and stops while its tab is hidden.
Viewing it needs the same permission as the query log: logs.read shows a division’s zones and what clients in its client networks asked; logs.server shows the whole server, and any division or zone in it.

What the numbers mean

  • One server. Each server counts what it answered itself. In a cluster the Server picker asks another one for its numbers. A DNZ secondary has its own numbers: open the page on it. The dashboard’s charts add up every server of a cluster, so its totals can be higher.
  • What was logged. Counting happens as the query log is written. If the log’s queue is full, queries are left out of both, and the page tells you how many since the server started. Queries the rate limit drops are never counted.
  • Top lists are capped. Each hour a list keeps its busiest 1,000 items, and 100 within one zone. The rest are added up as others, so a flood of random names can’t grow what is kept, and a list can read lower than the totals. The totals stay exact.
  • Top lists count whole hours, and whole days beyond the last two. The page says from when.
  • p50 and p95 are estimates from a histogram of answer times between 100 µs and 5 s.
  • Upstreams show counters since the server started, whatever the span, and only for the whole server.

How long it is kept

Counts hold no names or clients, so a 30-day span shows 30 days of counts even with 7 days of log, and the page says how far the top lists reach. Clear log empties the top lists too; the counts stay. Each server keeps these in its own file, <data folder>/logs/rollups.sqlite, on every database. Like the log files it isn’t in DNZ’s backups: without it, the page starts over and fills up again.

From the command line

The MCP tool dns_analytics answers the same.

API

Parameters: range (1h, 6h, 24h, 7d, 30d), zone (an id), division (an id, on the server-wide paths), node (another server of a cluster); on /top, list (names, blocked, clients, zones, countries), page and per_page (10 unless asked, at most 100).

With --proxy-only

The page doesn’t exist on a server that manages reverse proxies only: it has no DNS, so no queries to count.