Unix and Linux network configuration. Multiple network interfaces. Bridged NICs. High-availability network configurations.


Reviews of latest Unix and Linux software. Helpful tips for application support admins. Automating application support.


Disk partitioning, filesystems, directories, and files. Volume management, logical volumes, HA filesystems. Backups and disaster recovery.


Distributed server monitoring. Server performance and capacity planning. Monitoring applications, network status and user activity.

Commands & Shells

Cool Unix shell commands and options. Command-line tools and application. Things every Unix sysadmin needs to know.

Home » Commands & Shells

BIND DNS Query Frequency Analysis

Submitted by on September 6, 2016 – 1:30 pm

The little script (dns_qpm2) below will look through your BIND query logs and calculate average query-per-minute rate for the given clients.e Nothing fancy, but can be useful in identifying the heavy-hitters.

IFS=$'\n' ; a=($(grep -oPh "(?<=client )([0-9]{1,3}\.){3}([0-9]{1,3})(?=#)" "${f}" | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | uniq)) ; unset IFS
printf '%s\n' ${a[@]} | while read client
fqdn=$(dig +short -x ${client} 2>/dev/null | sed 's/\.$//g')
if [ -z "${fqdn}" ] ; then fqdn="${client}" ; fi
cn=$(grep -c "client ${client}#" ${f})
timediff="$(echo "scale=0;$(echo "$(date -d "$(tail -1 ${f} | awk '{print $1,$2}')" +%s)-\
$(date -d "$(head -1 ${f} | awk '{print $1,$2}')" +%s)"|bc -l)"/60*1|bc -l)"
printf "%-18s %-46s %-12s" "${client}" "${fqdn}" "${cn}"
echo "scale=0;$(grep -c "client ${client}#" ${f})/${timediff}*1"| bc -l | sort -n | awk '
c = 0;
sum = 0;
$1 ~ /^([-+])?[0-9]*(\.[0-9]*)?$/ {
a[c++] = $1;
sum += $1;
ave = sum / c;
done | sort -k3nr | (echo "IP FQDN Q Q/min" && cat) | column -t


Print Friendly, PDF & Email

No Comment »

1 Pingbacks »

  • […] Analyzing DNS logs is certainly helpful. However, sometimes it’s also useful to be able to watch DNS queries in real time. Below is a quick script that uses tshark to do just that. It will listen on the default NIC for one minute and tell you which external systems have sent DNS queries. […]

Leave a Reply

%d bloggers like this: