mirror of
https://github.com/isc-projects/bind9.git
synced 2026-03-07 16:00:34 -05:00
705810d577
The first attempt to add DNSSEC sign statistics was naive: for each zone we allocated 64K counters, twice. In reality each zone has at most four keys, so the new approach only has room for four keys per zone. If after a rollover more keys have signed the zone, existing keys are rotated out. The DNSSEC sign statistics has three counters per key, so twelve counters per zone. First counter is actually a key id, so it is clear what key contributed to the metrics. The second counter tracks the number of generated signatures, and the third tracks how many of those are refreshes. This means that in the zone structure we no longer need two separate references to DNSSEC sign metrics: both the resign and refresh stats are kept in a single dns_stats structure. Incrementing dnssecsignstats: Whenever a dnssecsignstat is incremented, we look up the key id to see if we already are counting metrics for this key. If so, we update the corresponding operation counter (resign or refresh). If the key is new, store the value in a new counter and increment corresponding counter. If all slots are full, we rotate the keys and overwrite the last slot with the new key. Dumping dnssecsignstats: Dumping dnssecsignstats is no longer a simple wrapper around isc_stats_dump, but uses the same principle. The difference is that rather than dumping the index (key tag) and counter, we have to look up the corresponding counter. |
||
|---|---|---|
| .. | ||
| bind9 | ||
| dns | ||
| irs | ||
| isc | ||
| isccc | ||
| isccfg | ||
| ns | ||
| samples | ||
| win32/bindevt | ||
| .gitignore | ||
| Kyuafile | ||
| Makefile.in | ||