Handling logging of queries from keepalived

[gmckeown]

In my homelab, I've got a three-node Technitium cluster running on Pi 4Bs. These have keepalived with three virtual IPs configured to balance the load and handle outages. My keepalived config uses dig to query localhost on the host interface, e.g.:

script "/usr/bin/dig @192.168.130.2 localhost +short +time=1 +tries=1"

Unfortunately this sticks an entry in my query logs every 2 seconds. Sure, I can filter these out, but I'd rather just not log them in the first place.

How might I stop these queries being logged?

[Hemsby]

Check against the API instead. The one to use is the SSO Status because it does not require a token.

All API Calls have a status response at the end. So just check for status ok.

script "/usr/bin/curl -sf http://192.168.130.2:5380/api/sso/status | grep -q '\"ok\"'"

A Status OK will be a zero 0, and any failure will be non-zero.

[gmckeown]

Thanks, I'll check that out. Is it possible/likely to get an OK response from that API even if the server has a problem that prevents it from serving DNS requests?

[Hemsby]

From a networking perspective, yes its possible. But if you want to be testing for successful DNS responses, then you will have the issue you mentioned of the very frequent DNS lookups because currently there is no way to ignore logging for specific records or zones. My approach was basically testing if the API endpoint (ie the Technitium service) is up and running.

[ShreyasZare]

Thanks for asking. There is no option to ignore query logs for any specific criteria. If you are using one of the Query Logs app, you can ignore these query logs when you query the db manually.

[gmckeown]

Good to have confirmation, thanks Shreyas. Would this be considered as a feature request?

[ShreyasZare]

A health check API call which check with an internal DNS query is possible. Will evaluate similar options and see which one works better.

[gmckeown]

That would be a fantastic option!

[ShreyasZare]

So just evaluated this API option. So, this API call will tell you if the DNS server is up as in that the web service is running, and it will tell you if the DNS resolution is working for the specified domain name. This DNS resolution is done internally and wont get logged anywhere else. The only thing it wont be able to tell is if the port 53 is open and that it is able to accept DNS requests. Does that sound reasonable for you to use it for health check?

[gmckeown]

That would absolutely work for me.

[ShreyasZare]

Technitium DNS Server v15.3 is now available which adds new health check API. Do update and let me know your feedback.

[gmckeown]

Initial tests are positive. Had some weirdness with the API key taking some time to sync across the cluster, but once that was done all my updated healthchecks seem to be behaving themselves. Thanks!

[ShreyasZare]

Thanks for the feedback!