From 3a3f40e3729e1e3ab32f6c18eeecfd4749812ffb Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 21 Jun 2019 11:11:25 +0200
Subject: [PATCH] DNSSEC sign metrics: CHANGES, doc, release note

Add some information about the new statistic-channel DNS sign
metrics. Also add a CHANGES and release note entry.
---
 CHANGES                 |  5 +++++
 doc/arm/Bv9ARM-book.xml |  2 ++
 doc/arm/notes.xml       | 14 ++++++++++++++
 3 files changed, 21 insertions(+)

diff --git a/CHANGES b/CHANGES
index e85adfb68e..9435f6ee94 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+5254.	[func]		Collect metrics to report to the statistics-channel
+			DNSSEC signing operations (dnssec-sign) and refresh
+			operations (dnssec-refresh) per zone and per keytag.
+			[GL #513]
+
 5253.	[port]		Support platforms that don't define ULLONG_MAX.
 			[GL #1098]
 
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 4a27aa8024..77b8adde78 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -5425,6 +5425,8 @@ options {
 		<command>zone-statistics terse</command> or
 		<command>zone-statistics none</command>
 		in the <command>zone</command> statement).
+		These include, for example, DNSSEC signing operations
+	        and the number of authoritative answers per query type.
 		The default is <userinput>terse</userinput>, providing
 		minimal statistics on zones (including name and
 		current serial number, but not query type
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index c51873b8fc..275e6489d5 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -143,6 +143,20 @@
 	  [GL #865]
         </para>
       </listitem>
+      <listitem>
+	<para>
+	  Two new metrics have been added to the
+	  <command>statistics-channel</command> to report DNSSEC
+	  signing operations.  For each key in each zone, the
+	  <command>dnssec-sign</command> counter indicates the total
+	  number of signatures <command>named</command> has generated
+	  using that key since server startup, and the
+	  <command>dnssec-refresh</command> counter indicates how
+	  many of those signatures were refreshed during zone
+	  maintenance, as opposed to having been generated
+	  as a result of a zone update.  [GL #513]
+	</para>
+      </listitem>
     </itemizedlist>
   </section>