This page displays a list of DNS zone transfers.
Zone transfers are detected by Stork agents on the machines with running BIND 9 servers. The list presented below is by default sorted from the most recently started zone transfers.
Looking into the zone transfers can be useful for troubleshooting issues between the primary and secondary DNS servers. Specifically, it is interesting to look at the durations of the zone transfers, their transmission rates (in B/s), and the status. For example, the completed status indicates that the zone transfer has been completed successfully. This status is typically indicating that the communication between the primary and secondary is healthy. However, a longer than expected duration may indicate some issues with the link or the server being overloaded. The duration of the completed zone transfer is extracted from the BIND 9 logs.
The up-to-date status also indicates successful completion of the zone transfer. In this case, however, the secondary does not receive the zone contents from the primary but rather confirms that the zone copy it has is up to date. That's why it is common to see only one record as part of the zone transfer, which is the SOA record.
The started status indicates that the zone transfer had not finished before the list of transfers was displayed. Click the Refresh List button to check whether the started transfers have already ended. The current duration of the started transfer is estimated by subtracting the Started at timestamp from the current time.
The message status indicates that Stork did not find the log message in the BIND 9 logs marking successful completion of the zone transfer. It is possible that BIND 9 emitted some intermediate log messages during the transfer or the transfer was interrupted or failed.
Failed zone transfers are marked with the failed status. For those transfers, the captured BIND 9 logs clearly indicate that the zone transfer was neither successful nor up-to-date.
The Primary and Secondary columns include the machine names or IP addresses of the primary and secondary DNS servers participating in the zone transfers. The machine names appear in cases when the zone transfer occurred on the machine monitored by Stork. The IP addresses are shown for the external DNS servers. Suppose the secondary DNS server is running on the monitored machine and transfers a zone from the external DNS server. In that case the Secondary column will contain the machine name. The Primary column will contain an IP address.
The table rows are expandable. Expand the row for the selected transfer to see the details such as timestamps, statistics, and the log messages (captured from BIND 9 instance) pertaining to this zone transfer.
The Started at and Completed at timestamps indicate when the transfer started and completed respectively. The Created at timestamp indicates when the transfer was first captured and recorded by Stork. It is often later than the Started at timestamp. It can be later than the Completed at timestamp.
The logs in the expanded row can be helpful to investigate why the zone transfer status is set to message. It may provide some error details.
Some zone transfers may be marked as local. These are the transfers where the primary and the secondary run on the same machine. Note that Stork initiates such transfers to fetch the zone contents from the DNS servers. In this case, Stork agent is a secondary and BIND 9 server is a primary. Local transfers are by default excluded from the table. They can be shown by selecting the Include local transfers checkbox in the filtering panel.
Zone transfers in the table below can be filtered by explicitly selected fields using text, dropdown or multiselect input filters. The currently supported fields for explicit filtering are:
Zone transfers can also be filtered by entering text in the search box; the table shows all transfers matching the exact or partial filter text. The text is matched against the zone name, view, primary IP address, secondary IP address or log message emitted during the zone transfer. For clarity, the (root) keyword marks a root zone. Typing (root) or root will return the transfer for the root zone.
The Include local transfers checkbox toggles the local zone transfers on/off. Turning them on will show all transfers initiated by Stork agent to get the zone contents from the DNS servers. It will also show all other local zone transfers.
Multiple filtering conditions are combined using logical AND (i.e., filtered zone transfers match all specified conditions).
Some operators may be interested in filtering the zone transfers for the specific primary/secondary server pair. It can be done by selecting the primary and the secondary machines using the Primary and Secondary dropdowns in the filtering panel. However, the dropdown cannot be used in cases when the primary or the secondary is external (i.e., is not monitored by Stork). In this case, use the text filter to search by the external server's IP address instead.
| Created at: | {{ zoneTransfer.createdAt | localtime }} |
| Started at: | {{ zoneTransfer.startedAt | localtime }} |
| Completed at: | {{ zoneTransfer.completedAt | localtime }} |
| Messages received: | {{ zoneTransfer.messagesCount ?? 0 }} |
| Records received: | {{ zoneTransfer.recordsCount ?? 0 }} |
| Bytes received: | {{ zoneTransfer.bytesCount ?? 0 }} |