Monitor and Alert if a DNS record IP changes?

[Daniel Blanco]

Hello, was looking at the dns_response probe but not sure if it can alert on this particular situation.

Can the dns_response probe monitor a DNS record and alarm if it changes? For example www.abc.com is supposed to resolve to 1.2.3.4, can we set the probe to generate an alert if it changes to something other than 1.2.3.4?

If this probe can't do this then are there other probes that can besides logmon which I know can do everything...   :-D

 

 

 

[David Michel]

Perhaps, dns_response has an option to alarm for Reverse Lookup IP failure.

[Stephen Danseglio]

The dns_response probe alarms in a few situations and includes if a lookup fails or there is no response. The DNS Response Monitoring probe queries your Domain Name Server (DNS) and monitors the response time from the server. The probe can also query the DNS looking for A records (normal hostnames), MX records (mail servers), and NS records (name servers).

 

It does monitor a DNS lookup failure, e.g., DNS lookup of 'www.abc.com' failed (type 'a') on nameserver '<nameserver> ' for profile '<TestThis Host>' 

 

Reverse lookup as well.

[Daniel Blanco]

Thanks Dave, Steve. Just FYI ATM, the dns_response probes HELP buttons loads up a broken Help Page in v1.68 and the wiki pages for the probes IM reference pages are also broken. So I can't check how the probe works. 

 

But in general we can't say if the probe gets back the wrong IP address for abc.com throw an alert. Its just alerts if there is no response or if the lookup fails. 

The reverse lookup won't help either b/c if I say lookup 1.2.3.4 and it returns say xyz.com its still a response so probe thinks its a working link.

I don't see how or if its possible to specify the reverse lookup IP and if I specify the Host/Domain as "abc.com" I can't tell the probe you should expect what I specified in the Host/Domain field. Meaning if it doesn't match then alert.

 

If this probe can't do this are there other probes than or is it back to logmon and doing a nslookup or ping and if the return value's REGEX doesn't match on 1.2.3.4 then alert... ?

[Stephen Danseglio]

Yes, I would use logmon.