DNSmetrics: Unified Metrics Collection From Multiple DNS Providers
We’re excited to share that we’re open-sourcing the tool we use to gather and transform the metrics from our managed DNS providers. We use DNSmetrics to supply data in a standard format to our SRE team’s monitoring and alerting systems, and we hope it can be useful for you too.
The central role of DNS
Here at PagerDuty, we care a lot about reliability and availability of our service. Availability is a key requirement in the design of our internal infrastructure, but the same requirements should also be applied to infrastructure we do not own. PagerDuty leverages third-party providers for some of the essential infrastructure components, and today we will talk about one of them: DNS.
The Domain Name System is responsible for translating domain names, like pagerduty.com, to network addresses of servers that can answer API and web application requests. Since addresses can change, most systems (and just about all humans) use names so if DNS is not available for our domain, our services become unreachable for a majority of our customers. Therefore, having DNS available and correctly configured is crucial.
DNS providers understand this and maintain a global network of highly available systems. However, large systems are not infallible, and the nature of DNS makes it particularly susceptible to DoS attacks. In fact, many of the big names in the Managed DNS providers space have had at least one big service disruption over the past few years (a few examples: 1, 2, 3, 4). PagerDuty has been using a single provider in the past, but we no longer consider that sufficiently robust. Currently, we rely on two providers for our DNS needs, in an active-active configuration (each provider is responsible for approximately half of our production traffic).
Why we built DNSmetrics and how it helps
Setting up monitoring and alerting across both of our DNS providers proved challenging. While each provider has overviews and reports available in their administration interface, the reports are different between providers: in selection of metrics exposed, in location of the same data within different interfaces, in time interval used for averages and reports, and so on. It took more effort and different screens to obtain a good snapshot of state of DNS across our providers and zones than we were comfortable with, and we wanted to use our own tooling for alerting capabilities (in particular around the interaction of both providers, for example tracking that neither provider is getting more than a certain share of our total traffic).
We needed a better solution and none was available, so we built one. It is a service that connects to both of our DNS providers using their APIs and pulls out metrics of interest to us. These metrics are normalized into the same namespace and units, and emitted in a standard statsd format for ingestion into any time-series monitoring system.
Instead of two different administrative interfaces and multiple screens on each of them, we now have a single dashboard that provides an overview of the health of our DNS aggregated across all providers and zones:
In addition, now that we had the time-series metrics in one place, we could apply the full expressive power of time-series queries (DataDog monitors, in our case) to set up flexible alerting on our DNS in aggregate across all providers, per provider, and per zone as necessary.
Monitoring managed DNS providers is a problem that is in no way unique to PagerDuty’s SRE team, so we decided to open-source DNSmetrics. Currently it only supports the providers we use, but extending coverage to other providers should be straightforward as long as they have a REST API that exposes commonly used metrics. Trying out DNSmetrics is as easy as running a Docker container, and we hope you will give it a spin and perhaps find a place for it in your environment as well.