CoreDNS Dashboard Templates

Prerequisites

• CoreDNS logs have been collected to LTS.
• Logs have been structured. For details, see Setting Cloud Structuring Parsing.

Viewing CoreDNS Log Analysis

1. Log in to the LTS console.
2. In the navigation pane, choose Dashboards.
3. Choose CoreDNS Dashboard Templates under Dashboard Templates and click CoreDNS Log Analysis to view the detailed charts.
   Figure 1 CoreDNS Log Analysis
   
   • Filter by domain name. The associated query and analysis statement is:

     * | SELECT name group by name limit 10000

   • Filter by client IP address. The associated query and analysis statement is:

     * | SELECT remote group by remote limit 10000

   • Filter by status code. The associated query and analysis statement is:

     * | SELECT rcode group by rcode limit 10000

   • Total Requests. The associated query and analysis statement is:

     *| SELECT diff[1] as nowCount, diff[1] - diff[2] as delta from (select compare(total, 86400) as diff from( select count(1) as total from log ) )

   • NXDOMAIN Times. The associated query and analysis statement is:

     (* and  rcode: NXDOMAIN) | SELECT diff[1] as nowCount, diff[1] - diff[2] as delta from  (select compare(total, 86400) as diff from(  select count(1) as total from log ) )

   • Request Success Rate. The associated query and analysis statement is:

     *| SELECT diff[1] as nowCount, round(diff[1] - diff[2], 2) as delta from  (select compare(total, 86400) as diff from(  select round( count_if(rcode = 'NOERROR' or rcode = 'NXDOMAIN') * 100.0 / (case when count(1) = 0 then 1 else count(1) end), 2 ) as total from log ) )

   • Domain Names. The associated query and analysis statement is:

     *| SELECT diff[1] as nowCount, diff[1] - diff[2] as delta from  (select compare(total, 86400) as diff from(  select approx_distinct(name) as total from log ) )

   • Average Latency. The associated query and analysis statement is:

     *| SELECT diff[1] as nowCount, round(diff[1] - diff[2],3 ) as delta from  (select compare(total, 86400) as diff from(  select round(avg(duration * 1000), 3) as total from log ) )

   • Timeouts. The associated query and analysis statement is:

     (level : ERROR) | SELECT diff[1] as nowCount, round(diff[1] - diff[2], 3)  as delta from  (select compare(total, 86400) as diff from( select count(1) as "total" from log where errmsg like '%timeout%' ) )

   • P95 Latency. The associated query and analysis statement is:

     *| SELECT diff[1] as nowCount, round(diff[1] - diff[2], 3) as delta from  (select compare(total, 86400) as diff from(  select round(approx_percentile(duration * 1000, 0.95), 3) as total from log ) ) 

   • P99 Latency. The associated query and analysis statement is:

     *| SELECT diff[1] as nowCount, round(diff[1] - diff[2], 3) as delta from  (select compare(total, 86400) as diff from(  select round(approx_percentile(duration * 1000, 0.99), 3) as total from log ) ) 

   • QPS. The associated query and analysis statement is:

     *| SELECT date_format(t, '%Y-%m-%d %H:%i') as time , d[1] as "Today", d[2] as "Yesterday", d[3] as "Last week" from( select t, ts_compare(pv, 86400,604800 ) as d from(select from_unixtime(__time - __time % 60000) as t, round(count(1)/ 60.0, 2 ) as pv from log group by t order by t ) group by t ) where date_format(t, '%Y-%m-%d %H:%i') is not null order by time limit 10000

   • Average Request Latency (ms). The associated query and analysis statement is:

     *| SELECT date_format(t, '%Y-%m-%d %H:%i') as time , d[1] as "Today", d[2] as "Yesterday", d[3] as "Last week" from( select t, ts_compare(pv, 86400,604800 ) as d from(select from_unixtime(__time - __time % 60000) as t, round(avg(duration * 1000.0), 3 ) as pv from log where level = 'INFO' group by t order by t ) group by t ) where date_format(t, '%Y-%m-%d %H:%i') is not null order by time limit 10000

   • Success Rate (%). The associated query and analysis statement is:

     *| SELECT date_format(t, '%Y-%m-%d %H:%i') as time , d[1] as "Today", d[2] as "Yesterday", d[3] as "Last week" from( select t, ts_compare(pv, 86400,604800 ) as d from(select from_unixtime(__time - __time % 60000) as t, round( count_if(rcode = 'NOERROR') * 100.0 / (case when count(1) = 0 then 1 else count(1) end), 2 )  as pv from log group by t order by t ) group by t ) where  date_format(t, '%Y-%m-%d %H:%i') is not null order by time limit 10000

   • P99 Latency (ms). The associated query and analysis statement is:

     *| SELECT date_format(t, '%Y-%m-%d %H:%i') as time , d[1] as "Today", d[2] as "Yesterday", d[3] as "Last week" from( select t, ts_compare(pv, 86400,604800 ) as d from(select from_unixtime(__time - __time % 60000) as t, round(approx_percentile(duration * 1000.0, 0.99), 3 ) as pv from log where level = 'INFO' group by t order by t ) group by t ) where date_format(t, '%Y-%m-%d %H:%i') is not null order by time limit 10000

   • Top Requested Domain Names. The associated query and analysis statement is:

     *| SELECT name, COUNT(*) as total where name  is not null group by name order by total desc

   • Status Code Distribution. The associated query and analysis statement is:

     *| SELECT rcode, COUNT(*) as total group by rcode order by total desc

   • Top Domain Names. The associated query and analysis statement is:

     *| SELECT name as "Domain Name", rcode as "Status Code", round(sum(size/ 1024.0), 3) as "Request Traffic (KB)", round(sum(rsize / 1024.0),3 ) as  "Return Traffic (KB)", COUNT(*) as "Requests", round(avg(duration * 1000), 3) as "Average Latency (ms)" where name  is not null group by name, rcode order by "Requests" desc

   • Top NXDOMAIN Domains. The associated query and analysis statement is:

     (* and  rcode: NXDOMAIN)| SELECT name as "Domain Name", rcode as "Status Code", round(sum(size/ 1024.0), 3) as "Request Traffic (KB)", round(sum(rsize / 1024.0),3 ) as  "Return Traffic (KB)", COUNT(*) as "Requests", round(avg(duration * 1000), 3) as "Average Latency (ms)" group by name, rcode order by "Requests" desc

   • Top Error Domain Names (Non-NXDOMAIN). The associated query and analysis statement is:

     (* not  rcode: NXDOMAIN not rcode : NOERROR)| SELECT name as "Domain Name", rcode as "Status Code", round(sum(size/ 1024.0), 3) as "Request Traffic (KB)", round(sum(rsize / 1024.0),3 ) as  "Return Traffic (KB)", COUNT(*) as "Requests", round(avg(duration * 1000), 3) as "Average Latency (ms)" where name  is not null group by name, rcode order by "Requests" desc

   • Top Requested Pods. The associated query and analysis statement is:

     *| SELECT remote as "IP", arbitrary(name) as "Request Domain Name Sample", round(sum(size/ 1024.0), 3) as "Request Traffic (KB)", round(sum(rsize / 1024.0),3 ) as  "Return Traffic (KB)", COUNT(*) as "Requests", round(avg(duration * 1000), 3) as "Average Latency (ms)" where remote  is not null group by remote order by "Requests" desc

   • Top NXDOMAIN Pods. The associated query and analysis statement is:

     (* and rcode : NXDOMAIN)| SELECT remote as "IP", arbitrary(name) as "Request Domain Name Sample", round(sum(size/ 1024.0), 3) as "Request Traffic (KB)", round(sum(rsize / 1024.0),3 ) as  "Return Traffic (KB)", COUNT(*) as "Requests", round(avg(duration * 1000), 3) as "Average Latency (ms)" where remote  is not null group by remote order by "Requests" desc

   • Top Error Pods (Non-NXDOMAIN). The associated query and analysis statement is:

     (* not rcode : NXDOMAIN not rcode : NOERROR)| SELECT remote as "IP", arbitrary(name) as "Request Domain Name Sample", round(sum(size/ 1024.0), 3) as "Request Traffic (KB)", round(sum(rsize / 1024.0),3 ) as  "Return Traffic (KB)", COUNT(*) as "Requests", round(avg(duration * 1000), 3) as "Average Latency (ms)" where remote  is not null group by remote order by "Requests" desc

   • Timeout Domain Names. The associated query and analysis statement is:

     (level : ERROR)| SELECT name as "Domain Name", count(1) as "Times" from log where errmsg like '%timeout%'  group by name order by "Times" desc limit 100

   • Recent 100 API Server Request Errors. The associated query and analysis statement is:

     (content : reflector.go)| SELECT date_format(from_unixtime(__time), '%Y-%m-%d %H:%i:%S') as "Time",  errmsg as "Error"  from log order by __time desc limit 100

   • Resolution Logs. The associated query and analysis statement is:

     (* and level: INFO and duration > 0.010)| SELECT name as "Domain Name", round( duration * 1000.0, 3) as "Latency (ms)", remote as "Requester", port as "Port", type as "Type", rcode as "Result" from log order by duration desc  limit 100