banshee/active-directory-collection/active-directory/winrm/dns-server

DNS Server, by WinRM

Returns the state of the DNS Server service of a Windows, and the state of each zone it hosts. Three watches are proposed, all checked: the service stopped, a zone paused or shut down, and a zone that is no longer hosted. Whether a name resolves, and to what, is the network/dns/resolution collector of banshee/network-collection.

How it works

The collector runs one PowerShell script, by WinRM, that reads the service, then, when it runs, the zones:

$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $state = [string](Get-CimInstance Win32_Service -Filter 'Name=''DNS''').State; $zones = @(); if ($state -eq 'Running') { $zones = @(Get-CimInstance -Namespace root/MicrosoftDNS -ClassName MicrosoftDNS_Zone | Select-Object Name, Paused, Shutdown) }; ConvertTo-Json -Compress -Depth 4 -InputObject @{service = $state; zones = $zones}

WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/dns-server, without the powershell -Command "…" that cmd.exe needs there.
The service is DNS, read in Win32_Service; its state is written by WMI in English whatever the language of the system, and returned in lower case, words joined by -: running, stopped, start-pending…
The zones are read in MicrosoftDNS_Zone (namespace root\MicrosoftDNS), the WMI class of the DNS Server that Microsoft documents: Name, the name of the zone; Paused, whether it is paused; Shutdown, whether this copy of the zone has expired, or is shut down. The state of a zone is shutdown when Shutdown is true, paused when Paused is, running otherwise. Every zone the server hosts is returned: primary, secondary, stub, conditional forwarder, and the reverse zones it creates by itself.
A DNS Server service not installed stops the collector as misconfigured, as does an answer that is not the expected JSON, a refused access to the WMI namespace among them. A stopped service returns its state, and no zone.

Nothing is written to the Windows: the script only reads.

Prerequisites

A Windows Server 2012 or later with the DNS Server role, a domain controller or not, with Windows PowerShell 3.0 or later.
The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection. NTLM authentication, which the WinRM service accepts as installed.
An account of the domain for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the group "Remote Management Users" (of the domain on a domain controller, the local one elsewhere). Never "DnsAdmins": that group administers the DNS Server, it does not only read it (see Limits).

Outputs

Name	Label	Unit	Per instance
`service`	DNS Server service	—	no
`state`	State	—	yes, per zone: `running`, `paused` or `shutdown`

Watches

Name	Title	Kind	Defaults	Checked by default
`service-stopped`	DNS Server stopped	expected value, on `service`	critical when the service is anything but `running`	yes
`zone-down`	Zone not served	state to avoid, on `state`	warning on `paused`, critical on `shutdown`	yes
`missing`	Zone missing	expected instances, on `state`	no zone named: it raises nothing until names are set on the probe	yes

Limits

Not yet checked on a real DNS Server: the execution; that an account without administrator rights may read root\MicrosoftDNS, which Microsoft does not document. If it may not, the collector stops as misconfigured with the error of Windows; the namespace is then opened to the account in its WMI security (wmimgmt.msc), in read only, and the DNS Server opened to it in reading, never by "DnsAdmins" or the administrators.