DSC: A DNS STATISTICS COLLECTOR

dsc is a system for collecting and exploring statistics from busy DNS servers. It currently has two major components:

Collector

The collector process uses libpcap to receive DNS messages sent and received on a network interface. It may run on the same machine as the DNS server, or on another system connected to a switch configured with port mirroring. A configuration file defines some number of datasets and other options. Datasets are dumped to disk every 60 seconds as XML files. A cron job copies the XML files to a separate server for archiving and further processing.

Presenter

This component receives XML datasets from collectors. Since parsing XML files is slower than we'd like, an extractor process converts them to another format. Currently that format is a line-based text file, although we may use a relational database in the future.

dsc uses a CGI script to display data in a web browser. The interface allows you to change time scales, select particular nodes within a server cluster, and isolate individual dataset keys.