Monitor DNS errors in a dashboard

To create your own dashboard to display DNS metrics, complete the following steps:

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. At the top of the page, click Dashboards.
3. Click the command menu in the upper right corner and select New Dashboard to create an empty dashboard.
4. Type a name for your dashboard in the Title field. For this walkthrough, type DNS Errors.
5. Click Create. When you create a new dashboard, a workspace opens in an editable layout mode. This workspace contains a single region and two empty widgets: a chart and a text box.
6. Text box widgets can include custom explanatory text about a dashboard or chart. For this walkthrough, however, we won't be adding text. Delete the text box by completing the following steps:
   1. Click the command menu in the upper right corner of the text box widget and select Delete.
   2. Click Delete Widget.

These steps show you how to create a chart to display the DNS error rate for a specified time interval.

1. Click the empty chart widget in your newly created dashboard to open the Metric Explorer.
2. Click Add Source.
3. In the Sources field, type All Activity to filter the results, and then select All Activity.
4. In the Metrics field, type DNS errors to filter the results from all of the available metrics, and then select DNS Errors.
5. From the bottom of the page, click the Value chart.
6. Click Count and select Average Rate.
   
7. Click Save to return to your dashboard.

Comparing the number of DNS errors to the number of DNS transactions (requests and responses) can help you gauge the scope of DNS issues on your network.

1. From the bottom of the page, click and drag a chart widget into the empty space next to the DNS error rate chart.
2. Click the chart.
3. Click Add Source and select All Activity.
4. In the Metrics field, click Any Protocol and select DNS. This shortcut can help you narrow down your search for metrics by protocol.
   
5. Type errors to filter results and then select DNS Errors.
6. From the bottom of the page, click the Bar chart.
7. Click Add Metric.
8. Click Any Protocols and select DNS from the drop-down menu.
9. Type responses and select DNS Responses.
10. Click Add Metric.
11. Click Any Protocols and select DNS from the drop-down menu.
12. Type requests and select DNS Requests.
13. Click the chart title and select Rename. Type Error Percentage in the custom title field.
    
14. Click Save.

Now that you have determined the scope of DNS errors, let's take a look at when the errors occurred and how they changed over time.

1. Click and drag a new chart widget from the bottom of the page into an empty space on the region.
2. Click the chart.
3. Click Add Source, select All Activity, and then select DNS Errors.
4. From the bottom of the page, click Line chart.
   
5. Click Save.

A host query is sent by a client to retrieve the IP address for a hostname (for example, for "extrahop.com") from a DNS server. If the DNS server responds to the query with an error, the server might be misconfigured for the domain associated with the hostname.

1. On the "Error Percentage" chart, click the command menu in the upper right corner.
   
2. Hover over Copy to… and select the name of your dashboard from the menu. This step creates a copy of the chart in a new region. The most recently created dashboards are listed at the bottom of the menu.
3. In the new region, click Rename. Type DNS Error Details and click Save.
   
4. Click the chart.
5. Click the chart title and type DNS Errors by Host Query.
6. From the bottom of the page, click Table.
7. In the Details section, click Drill down by <None> and select Host Query.
   

   Tip:	To display more queries, type a larger number into the Top results field. You can view up to 20 drill-down items in a dashboard chart.

8. Click Save.

Knowing which servers are returning DNS errors and how many errors each server sent can help you troubleshoot DNS issues.

1. Click and drag the corner of the region to make room for two more charts.
2. Click and drag a chart widget from the bottom of the page.
3. Click the chart.
4. Click Add Source, select All Activity, and then select DNS Errors.
5. From the bottom of the page, click Table.
6. In the Details section, click Drill down by <None> and select Server.
   
7. Click Save.

You can determine which applications, databases, and other servers are negatively affected by DNS errors. Let's create a chart that breaks down the number of DNS errors by the clients that received the most errors.

1. From the bottom of the page, drag and drop a chart widget into an empty area.
2. Click the chart.
3. Click Add Source, select All Activity, and then select DNS Errors.
4. From the bottom of the page, click the List chart.
5. In the Details section, click Drill down by <None> and select Client.
   

   Note:

   You can add a sparkline to your list chart to view how the number of metrics for each client changed over time. Click the Options tab and select Include sparkline.

6. Click Save.
7. At the top right corner of the dashboard page, click Exit Layout Mode.

By applying a delta comparison of time intervals to your charts, you can see changes in data from two time intervals side-by-side.

1. Click the region title, "DNS Error Details," and select Use Region Time Selector.
2. Next to the DNS Error Details region header, click Last 30 Minutes.
   
3. Near the bottom of the time interval window, click Compare. You can now select two intervals to do a delta comparison of metrics from each time period. For this example, let's compare metrics from yesterday to the last 30 minutes.
4. Click Save. You will now see a comparison of metrics in all charts within the region, as shown in the figure below.
   

   Note:

   You can do a delta comparison for the entire dashboard by changing the global time interval. The global time interval is located at the top left corner of the dashboard page.

5. To remove the delta comparison, click Last 30 minutes vs 1 day ago in the region header, click Remove Delta, and then click Save.