banshee/active-directory-collection/active-directory/ssh/dns-server

DNS Server, by SSH

Returns the state of the DNS Server service of a Windows, and the state of each zone it hosts. Three watches are proposed, all checked: the service stopped, a zone paused or shut down, and a zone that is no longer hosted. Whether a name resolves, and to what, is the network/dns/resolution collector of banshee/network-collection.

Versions

Windows Server 2012 and later with the DNS Server role, a domain controller or not, and Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real DNS Server.

How it works

The collector runs one PowerShell command that reads the service, then, when it runs, the zones:

powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $state = [string](Get-CimInstance Win32_Service -Filter 'Name=''DNS''').State; $zones = @(); if ($state -eq 'Running') { $zones = @(Get-CimInstance -Namespace root/MicrosoftDNS -ClassName MicrosoftDNS_Zone | Select-Object Name, Paused, Shutdown) }; ConvertTo-Json -Compress -Depth 4 -InputObject @{service = $state; zones = $zones}"

The service is DNS, read in Win32_Service; its state is written by WMI in English whatever the language of the system, and returned in lower case, words joined by -: running, stopped, start-pending…
The zones are read in MicrosoftDNS_Zone (namespace root\MicrosoftDNS), the WMI class of the DNS Server that Microsoft documents: Name, the name of the zone; Paused, whether it is paused; Shutdown, whether this copy of the zone has expired, or is shut down. The state of a zone is shutdown when Shutdown is true, paused when Paused is, running otherwise. Every zone the server hosts is returned: primary, secondary, stub, conditional forwarder, and the reverse zones it creates by itself.
A DNS Server service not installed stops the collector as misconfigured, as does an answer that is not the expected JSON, a refused access to the WMI namespace among them. A stopped service returns its state, and no zone.

Nothing is written to the Windows: the command only reads.

Prerequisites

A Windows Server 2012 or later with the DNS Server role, a domain controller or not, with Windows PowerShell 3.0 or later.
The OpenSSH server of Windows, installed and started, its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
An account for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key. Never "DnsAdmins": that group administers the DNS Server, it does not only read it (see Limits).

Outputs

Name	Label	Unit	Per instance
`service`	DNS Server service	—	no
`state`	State	—	yes, per zone: `running`, `paused` or `shutdown`

Watches

Name	Title	Kind	Defaults	Checked by default
`service-stopped`	DNS Server stopped	expected value, on `service`	critical when the service is anything but `running`	yes
`zone-down`	Zone not served	state to avoid, on `state`	warning on `paused`, critical on `shutdown`	yes
`missing`	Zone missing	expected instances, on `state`	no zone named: it raises nothing until names are set on the probe	no

Limits

Not yet checked on a real DNS Server: the execution; that an account without administrator rights may read root\MicrosoftDNS, which Microsoft does not document. If it may not, the collector stops as misconfigured with the error of Windows; the namespace is then opened to the account in its WMI security (wmimgmt.msc), in read only, and the DNS Server opened to it in reading, never by "DnsAdmins" or the administrators. Which right lets an account that is not an administrator open an SSH session on a domain controller.