Unbound DNSリゾルバ向けPrometheus ExporterとGrafana Dashboard導入

Unbound DNSリゾルバのサービス関連データを収集するPrometheus Exporterを導入、Grafana Dashboardで可視化してみました。

Grafana DashboardからUnbound用Exporterを選ぶ

Unbound向けのPrometheus Exporterはいくつかあるようで、まず標準的なのが、無料SSL証明書サービスで有名なLet’s EncryptさんのUnbound ExporterとそのGrafana Dashboard。

letsencrypt版

Grafana Labs

Unbound | Grafana Labs

GitHub

GitHub - letsencrypt/unbound_exporter: A Prometheus exporter for Unbound.

A Prometheus exporter for Unbound. Contribute to letsencrypt/unbound_exporter development by creating an account on GitHub.

他には、それぞれ専用のExporterを必要とするものの、見た目がリッチな以下の2つのGrafana Dashboardが見つかります。

svartalf版

Grafana Labs

Unbound | Grafana Labs

GitHub

GitHub - svartalf/unbound-telemetry: Prometheus exporter for Unbound DNS reso...

Prometheus exporter for Unbound DNS resolver. Contribute to svartalf/unbound-telemetry development by creating an account on GitHub.

ar51an版

Grafana Labs

Unbound | Grafana Labs

GitHub

GitHub - ar51an/unbound-exporter: Unbound Metrics Exporter For Prometheus

Unbound Metrics Exporter For Prometheus. Contribute to ar51an/unbound-exporter development by creating an account on GitHub.

今回は標準的なletsencrypt番のExporterとGrafana Dashboardを導入することにします。

letsencrypt版unbound-exporterのインストール

現在、Unboundが稼働しているのは、VMware ESXi 8.0上のApline Linux仮想マシンです（構築記事はこちら）。

~$ uname -a
Linux resolv9 6.6.37-0-virt #1-Alpine SMP PREEMPT_DYNAMIC 2024-07-05 10:31:13 x86_64 GNU/Linux
~$ cat /etc/os-release 
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.21.0_alpha20240606
PRETTY_NAME="Alpine Linux edge"

~$ uname -a

Linux resolv9 6.6.37-0-virt #1-Alpine SMP PREEMPT_DYNAMIC 2024-07-05 10:31:13 x86_64 GNU/Linux

~$ cat /etc/os-release

NAME="Alpine Linux"

ID=alpine

VERSION_ID=3.21.0_alpha20240606

PRETTY_NAME="Alpine Linux edge"

Alpine Linuxでは edge レポジトリの testing ディレクトリに、letsencrypt版のunbound-exporterがパッケージ収録されているので、レポジトリを有効にしてからインストール。

#/media/cdrom/apks
#http://ftp.udx.icscoe.jp/Linux/alpine/v3.17/main
#http://ftp.udx.icscoe.jp/Linux/alpine/v3.17/community
http://ftp.udx.icscoe.jp/Linux/alpine/edge/main
http://ftp.udx.icscoe.jp/Linux/alpine/edge/community
http://ftp.udx.icscoe.jp/Linux/alpine/edge/testing

#/media/cdrom/apks

#http://ftp.udx.icscoe.jp/Linux/alpine/v3.17/main

#http://ftp.udx.icscoe.jp/Linux/alpine/v3.17/community

http://ftp.udx.icscoe.jp/Linux/alpine/edge/main

http://ftp.udx.icscoe.jp/Linux/alpine/edge/community

http://ftp.udx.icscoe.jp/Linux/alpine/edge/testing

~$ sudo apk update
~$ apk search prometheus-unbound-exporter
prometheus-unbound-exporter-0.4.6-r0
prometheus-unbound-exporter-openrc-0.4.6-r0

~$ sudo apk add prometheus-unbound-exporter
(1/2) Installing prometheus-unbound-exporter (0.4.6-r0)
Executing prometheus-unbound-exporter-0.4.6-r0.pre-install
(2/2) Installing prometheus-unbound-exporter-openrc (0.4.6-r0)
Executing busybox-1.36.1-r31.trigger
OK: 287 MiB in 180 packages

~$ sudo apk update

~$ apk search prometheus-unbound-exporter

prometheus-unbound-exporter-0.4.6-r0

prometheus-unbound-exporter-openrc-0.4.6-r0

~$ sudo apk add prometheus-unbound-exporter

(1/2) Installing prometheus-unbound-exporter (0.4.6-r0)

Executing prometheus-unbound-exporter-0.4.6-r0.pre-install

(2/2) Installing prometheus-unbound-exporter-openrc (0.4.6-r0)

Executing busybox-1.36.1-r31.trigger

OK: 287 MiB in 180 packages

インストールされたファイルは、バイナリの他にサービス定義とその設定です。

バイナリ : /usr/bin/unbound_exporter
サービス定義 : /etc/init.d/unbound-exporter
サービス設定 : /etc/conf.d/unbound-exporter

#!/sbin/openrc-run
supervisor=supervise-daemon

command="/usr/bin/unbound_exporter"
command_args="$ARGS"
command_background="yes"
command_user="prometheus:prometheus"

logdir="/var/log/prometheus"
error_log="$logdir/${SVCNAME}.log"
pidfile="/var/run/${SVCNAME}.pid"

depend() {
	need net
	after firewall
}

start_pre() {
	checkpath -d -o $command_user -m755 $logdir
	checkpath -f -o $command_user -m644 $error_log
}

#!/sbin/openrc-run

supervisor=supervise-daemon

command="/usr/bin/unbound_exporter"

command_args="$ARGS"

command_background="yes"

command_user="prometheus:prometheus"

logdir="/var/log/prometheus"

error_log="$logdir/${SVCNAME}.log"

pidfile="/var/run/${SVCNAME}.pid"

depend() {

need net

after firewall

}

start_pre() {

checkpath -d -o $command_user -m755 $logdir

checkpath -f -o $command_user -m644 $error_log

}

# /etc/conf.d/unbound-exporter
# Custom arguments can be specified like:
# ARGS="--web.listen-address=':9100'"
ARGS=""

# /etc/conf.d/unbound-exporter

# Custom arguments can be specified like:

# ARGS="--web.listen-address=':9100'"

ARGS=""

unbound-controlの設定

続いて、unbound-exporterのGitHubページで解説されている通り、Unbound側でunbound-controlの機能を有効にします。これは以前、UnboundサーバのモニタリングにNetdataを導入した時と同じ要領です。

Fun Scripting 2.0

Alpine LinuxとUnboundで構築したDNSサーバをNetdataで監視

🕒️2023年6月22日

Alpine Linux 仮想マシンに Unbound を導入して構築した、DNSサーバの監視ツールとして、OpenWRTルータへ導入したことのある Netdata を試してみます。Alpine LinuxにNetdataパッケージをインストールNetdataをインストールしてみるのは前回、UnboundによるDNSフルサービスリゾルバを構築したAlpine Linux v3.17仮想マシンです。$ uname -aLinux resolv9 5.15.88-0-virt #1-Alpine SMP Mon, 16 Jan 2023 08:10:32 +0000 x86_64 Linux$ cat /etc/os-releaseNAME="Alpine Linux"ID=alpineVERSION_ID=3.17.1PRETTY_NAME="A...

/etc/unbound/unbound.conf を開き、以下の項目を確認、編集します。

server:
    extended-statistics: yes

remote-control:
    # Enable remote control with unbound-control(8) here.
    # set up the keys and certificates with unbound-control-setup.
    control-enable: yes
   
    # what interfaces are listened to for remote control.
    # give 0.0.0.0 and ::0 to listen to all interfaces.
    control-interface: 127.0.0.1

    # port number for remote control operations.
    #control-port: 8953
 
    # unbound server key file.
    server-key-file: "/etc/unbound/unbound_server.key"
 
    # unbound server certificate file.
    server-cert-file: "/etc/unbound/unbound_server.pem"
 
    # unbound-control key file.
    control-key-file: "/etc/unbound/unbound_control.key"
 
    # unbound-control certificate file.
    control-cert-file: "/etc/unbound/unbound_control.pem"

server:

extended-statistics: yes

remote-control:

# Enable remote control with unbound-control(8) here.

# set up the keys and certificates with unbound-control-setup.

control-enable: yes

# what interfaces are listened to for remote control.

# give 0.0.0.0 and ::0 to listen to all interfaces.

control-interface: 127.0.0.1

# port number for remote control operations.

#control-port: 8953

# unbound server key file.

server-key-file: "/etc/unbound/unbound_server.key"

# unbound server certificate file.

server-cert-file: "/etc/unbound/unbound_server.pem"

# unbound-control key file.

control-key-file: "/etc/unbound/unbound_control.key"

# unbound-control certificate file.

control-cert-file: "/etc/unbound/unbound_control.pem"

unboundサービスを再起動して、設定を反映させます。

~$ sudo rc-service unbound-exporter restart
 * Stopping unbound-exporter ...                                                                                              [ ok ]
 * Starting unbound-exporter ...                                                                                              [ ok ]

~$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:8125          0.0.0.0:*               LISTEN      2830/netdata
tcp        0      0 127.0.0.1:8953          0.0.0.0:*               LISTEN      2719/unbound
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      2719/unbound
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      2719/unbound
tcp        0      0 0.0.0.0:19999           0.0.0.0:*               LISTEN      2830/netdata
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2898/sshd [listener
tcp        0      0 :::9100                 :::*                    LISTEN      2859/node_exporter
tcp        0      0 ::1:8125                :::*                    LISTEN      2830/netdata
tcp        0      0 :::9167                 :::*                    LISTEN      3573/unbound_export
tcp        0      0 :::53                   :::*                    LISTEN      2719/unbound
tcp        0      0 :::53                   :::*                    LISTEN      2719/unbound
tcp        0      0 :::19999                :::*                    LISTEN      2830/netdata
tcp        0      0 :::22                   :::*                    LISTEN      2898/sshd [listener
udp        0      0 127.0.0.1:8125          0.0.0.0:*                           2830/netdata
udp        0      0 0.0.0.0:53              0.0.0.0:*                           2719/unbound
udp        0      0 0.0.0.0:53              0.0.0.0:*                           2719/unbound
udp        0      0 ::1:8125                :::*                                2830/netdata
udp        0      0 :::53                   :::*                                2719/unbound
udp        0      0 :::53                   :::*                                2719/unbound

~$ sudo rc-service unbound-exporter restart

* Stopping unbound-exporter ... [ ok ]

* Starting unbound-exporter ... [ ok ]

~$ sudo netstat -tulpn

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

tcp 0 0 127.0.0.1:8125 0.0.0.0:* LISTEN 2830/netdata

tcp 0 0 127.0.0.1:8953 0.0.0.0:* LISTEN 2719/unbound

tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 2719/unbound

tcp 0 0 0.0.0.0:19999 0.0.0.0:* LISTEN 2830/netdata

tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2898/sshd [listener

tcp 0 0 :::9100 :::* LISTEN 2859/node_exporter

tcp 0 0 ::1:8125 :::* LISTEN 2830/netdata

tcp 0 0 :::9167 :::* LISTEN 3573/unbound_export

tcp 0 0 :::53 :::* LISTEN 2719/unbound

tcp 0 0 :::19999 :::* LISTEN 2830/netdata

tcp 0 0 :::22 :::* LISTEN 2898/sshd [listener

udp 0 0 127.0.0.1:8125 0.0.0.0:* 2830/netdata

udp 0 0 0.0.0.0:53 0.0.0.0:* 2719/unbound

udp 0 0 ::1:8125 :::* 2830/netdata

udp 0 0 :::53 :::* 2719/unbound

unbound-exporterを直接実行

unbound-exporterを直接実行して、unboundとの疎通が確立しているか確認します。接続先ポートや証明書類を長々と引数に連結。

~$ sudo -u prometheus unbound_exporter \
> -unbound.ca "/etc/unbound/unbound_server.pem" \
> -unbound.cert "/etc/unbound/unbound_control.pem" \
> -unbound.key "/etc/unbound/unbound_control.key" \
> -unbound.host "tcp://localhost:8953"
level=info ts=2024-07-11T04:16:31.108Z caller=unbound_exporter.go:551 Startingunbound_exporter=(MISSING)
level=info ts=2024-07-11T04:16:31.109Z caller=unbound_exporter.go:569 Listeningonaddress:port>=:9167

~$ sudo -u prometheus unbound_exporter \

> -unbound.ca "/etc/unbound/unbound_server.pem" \

> -unbound.cert "/etc/unbound/unbound_control.pem" \

> -unbound.key "/etc/unbound/unbound_control.key" \

> -unbound.host "tcp://localhost:8953"

level=info ts=2024-07-11T04:16:31.108Z caller=unbound_exporter.go:551 Startingunbound_exporter=(MISSING)

level=info ts=2024-07-11T04:16:31.109Z caller=unbound_exporter.go:569 Listeningonaddress:port>=:9167

ブラウザでUnboundサーバの 9167 番ポートへアクセスしてメトリクスを確認。最後尾に unbound_up 1 とあれば、unbound-exporterはunbound-controlからデータを取得できています。

図1.ブラウザでメトリクスを直接確認

unbound-exporterサービス稼働

unbound-exporterの動かし方は確認できたので、プロセスを一旦止めてサービス設定ファイルにバイナリに渡す引数を記述します。

# /etc/conf.d/unbound-exporter

# Custom arguments can be specified like:
#
# ARGS="--web.listen-address=':9100'"

ARGS="-unbound.ca '/etc/unbound/unbound_server.pem' \
-unbound.cert '/etc/unbound/unbound_control.pem' \
-unbound.key '/etc/unbound/unbound_control.key' \
-unbound.host 'tcp://localhost:8953'"

# /etc/conf.d/unbound-exporter

# Custom arguments can be specified like:

# ARGS="--web.listen-address=':9100'"

ARGS="-unbound.ca '/etc/unbound/unbound_server.pem' \

-unbound.cert '/etc/unbound/unbound_control.pem' \

-unbound.key '/etc/unbound/unbound_control.key' \

-unbound.host 'tcp://localhost:8953'"

サービスを開始してみます。

~$ sudo rc-service unbound-exporter start
 * Caching service dependencies ... * /var/log/prometheus/unbound-exporter.log: creating file
 * /var/log/prometheus/unbound-exporter.log: correcting owner
 * Starting unbound-exporter ...                                                                                              [ ok ]

~$ rc-service unbound-exporter status
 * status: started

~$ sudo rc-service unbound-exporter start

* Caching service dependencies ... * /var/log/prometheus/unbound-exporter.log: creating file

* /var/log/prometheus/unbound-exporter.log: correcting owner

* Starting unbound-exporter ... [ ok ]

~$ rc-service unbound-exporter status

* status: started

サービスが正常に動作するのを確認したら、サーバ起動時に自動開始するよう設定します。

~$ sudo rc-update add unbound-exporter default
 * service unbound-exporter added to runlevel default

~$ rc-status
Runlevel: default
 open-vm-tools                                                  [  started  ]
 unbound                                                        [  started  ]
 chronyd                                                        [  started  ]
 acpid                                                          [  started  ]
 crond                                                          [  started  ]
 pihole-exporter                                    [  started 00:14:09 (0) ]
 unbound-exporter                                   [  started 00:01:54 (0) ]
 sshd                                                           [  started  ]
 pihole-FTL                                                     [  started  ]
 node-exporter                                      [  started 00:14:11 (0) ]
 lighttpd                                                       [  started  ]
Dynamic Runlevel: hotplugged
Dynamic Runlevel: needed/wanted
 sysfs                                                          [  started  ]
 fsck                                                           [  started  ]
 root                                                           [  started  ]
 localmount                                                     [  started  ]
Dynamic Runlevel: manual

~$ rc-update show
                acpid |      default                           
             bootmisc | boot                                   
              chronyd |      default                           
                crond |      default                           
                devfs |                                 sysinit
                dmesg |                                 sysinit
             hostname | boot                                   
              hwclock | boot                                   
            hwdrivers |                                 sysinit
            killprocs |                        shutdown        
             lighttpd |      default                           
             loadkmap | boot                                   
                 mdev |                                 sysinit
              modules | boot                                   
             mount-ro |                        shutdown        
           networking | boot                                   
        node-exporter |      default                           
        open-vm-tools | boot default                           
           pihole-FTL |      default                           
      pihole-exporter |      default                           
            savecache |                        shutdown        
              seedrng | boot                                   
                 sshd |      default                           
                 swap | boot                                   
               sysctl | boot                                   
               syslog | boot                                   
              unbound |      default                           
     unbound-exporter |      default

~$ sudo rc-update add unbound-exporter default

* service unbound-exporter added to runlevel default

~$ rc-status

Runlevel: default

open-vm-tools [ started ]

unbound [ started ]

chronyd [ started ]

acpid [ started ]

crond [ started ]

pihole-exporter [ started 00:14:09 (0) ]

unbound-exporter [ started 00:01:54 (0) ]

sshd [ started ]

pihole-FTL [ started ]

node-exporter [ started 00:14:11 (0) ]

lighttpd [ started ]

Dynamic Runlevel: hotplugged

Dynamic Runlevel: needed/wanted

sysfs [ started ]

fsck [ started ]

root [ started ]

localmount [ started ]

Dynamic Runlevel: manual

~$ rc-update show

acpid | default

bootmisc | boot

chronyd | default

crond | default

devfs | sysinit

dmesg | sysinit

hostname | boot

hwclock | boot

hwdrivers | sysinit

killprocs | shutdown

lighttpd | default

loadkmap | boot

mdev | sysinit

modules | boot

mount-ro | shutdown

networking | boot

node-exporter | default

open-vm-tools | boot default

pihole-FTL | default

pihole-exporter | default

savecache | shutdown

seedrng | boot

sshd | default

swap | boot

sysctl | boot

syslog | boot

unbound | default

unbound-exporter | default

Unboundサーバ側の作業は以上です。次ページでは、コレクタ側のPrometheusとそのフロントエンドGrafanaの設定へ進みます。

Prometheus実践ガイドクラウドネイティブな監視システムの構築

created by Rinker

わかばちゃんと学ぶサーバー監視

created by Rinker

ページ : 1 2

Grafana DashboardからUnbound用Exporterを選ぶ

letsencrypt版unbound-exporterのインストール

unbound-controlの設定

unbound-exporterを直接実行

unbound-exporterサービス稼働

共有:

関連

コメントを残す コメントをキャンセル

コメントを残すコメントをキャンセル