DNS check type issue

Could this be broken in my release (7.15.2)



I test 2 dns servers for the same www alias, one internal and one external server.



It looks like the dns test ALWAYS takes the default dns server. So changing the dns server in the IP config of serverscheck appliance, always results in 1 of 2 checks being OK.

ServersCheck uses the nslookup feature. Run the monitoring service in debug mode as per knowledge base article (http://kb.serverscheck.com/index.php?page=index_v2&id=33&c=6) Let the monitoring service run and perform the DNS check. Make sure to pause all other monitors and reply with the output generated.

Hi,

I left out all the non-interesting lines and came up with what I've expected:



# S-0 Wed Mar 18 10:12:23 2009 1232634171DNS - Starting check - 5

# Wed Mar 18 10:12:23 2009 testing against DNS 172.16.0.164 (type: A) - result:194.7.34.136

# S-0 Wed Mar 18 10:12:23 2009 1232634171DNS - s:OK - e: - v: - t:1237367543

# S-1 Wed Mar 18 10:13:35 2009 1232371355DNS - Starting check - 0

# Wed Mar 18 10:13:35 2009 testing against DNS 10.0.22.15 (type: A) - result: 194.7.34.136

# S-1 Wed Mar 18 10:13:40 2009 1232371355DNS - s:DOWN? - e:DNS server returned different IP for host: 194.7.34.136 - v: - t:191

# S-1 Wed Mar 18 10:13:49 2009 1232371355DNS - Starting check - 0

# Wed Mar 18 10:13:49 2009 testing against DNS 10.0.22.15 (type: A) - result: 194.7.34.136

# S-1 Wed Mar 18 10:13:54 2009 1232371355DNS - s:DOWN? - e:DNS server returned different IP for host: 194.7.34.136 - v: - t:14

# S-1 Wed Mar 18 10:14:03 2009 1232371355DNS - Starting check - 0

# Wed Mar 18 10:14:04 2009 testing against DNS 10.0.22.15 (type: A) - result: 194.7.34.136

# S-1 Wed Mar 18 10:14:09 2009 1232371355DNS - s:DOWN? - e:DNS server returned different IP for host: 194.7.34.136 - v: - t:29

# S-1 Wed Mar 18 10:14:18 2009 1232371355DNS - Starting check - 0

# Wed Mar 18 10:14:18 2009 testing against DNS 10.0.22.15 (type: A) - result: 194.7.34.136

# Wed Mar 18 10:14:18 2009 3>=3 and DOWN? ne 'WARNING'

# S-1 Wed Mar 18 10:14:18 2009 1232371355DNS - s:DOWN - e:DNS server returned different IP for host: 194.7.34.136 - v: - t:9

# S-0 Wed Mar 18 10:15:29 2009 1232634171DNS - Starting check - 6

# Wed Mar 18 10:15:29 2009 testing against DNS 172.16.0.164 (type: A) - result:194.7.34.136

# S-0 Wed Mar 18 10:15:29 2009 1232634171DNS - s:OK - e: - v: - t:186



however, via nslookup on the appliance, all works fine:



Default Server: [172.16.0.164]

Address: 172.16.0.164

> www.whatever.com

Server: [172.16.0.164]

Address: 172.16.0.164



Name: www.whatever.com

Address: 194.7.34.136



> server 10.0.22.15

Default Server: [10.0.22.15]

Address: 10.0.22.15



> www.whatever.com

Server: [10.0.22.15]

Address: 10.0.22.15



Name: www.whatever.com

Address: 172.16.0.131

so, to simplify:

checking whatever.com via the rules:

2009 testing against DNS 10.0.22.15 (type: A) - result:

194.7.34.136 (wrong)



and via nslookup, on same machine:

> www.whatever.com

Server: [10.0.22.15]

Address: 10.0.22.15



Name: www.whatever.com

Address: 172.16.0.131 (correct)

What is the command you do in the command prompt - what are the parameters?

Not sure I follow you, but this e.g. is at the command prompt (which is both correct):



C:Documents and Settingsadmin>nslookup www.whatever.com 10.0.22.15

Server: nt08.whatever.local

Address: 10.0.22.15



Name: www.whatever.com

Address: 172.16.0.131



C:Documents and Settingsadmin>nslookup www.whatever.com 172.16.0.164



Server: dns1.whatever.be

Address: 172.16.0.164



Name: www.whatever.com

Address: 194.7.34.136

But with that command you are not check the A record entry



In your case the same command would be:

nslookup -type=A www.whatever.com 10.0.22.15



Also don't forget that you are running it through the Monitoring Software under a service and that as such access rights or connection settings loaded can be different depending on your network setup

the -type=A gives exactly the same result.



What exactly does the serverscheck command do?

It natively communicates with DNS server and overrides any internal settings like routing etc.. that may be assigned to a user affecting the windows command prompt nslookup

By natively you mean it doesn't use other ports than UPD 53 & TCP 53? Or does it?



Because, like I said, it works by changing the default dns server of the appliance. And also via nslookup.