Monitoring Unbound on Pfsense with Zabbix

Unbound dashboard in Zabbix

Shortly after finishing my story on monitoring Pfsense with Zabbix I decided to look at Pfblocker-ng. Pfblocker-ng blocks IP addresses with the packet filter (PF) and DNS queries with unbound. My previous article already addressed instrumenting PF and gaining visibility into rules on PFsense for ingress and egress, but I had no visibility into unbound and it’s performance. The rest of this article assumes that you have installed the Zabbix agent on your Pfsense firewall.

Acquiring the Data

Unbound stats are enabled by default on Pfsense. To access them from command line you need to specify your unbound config file. After you ssh to the host you can see the stats with

# unbound-control -c /var/unbound/unbound.conf stats
thread0.num.queries=1047325
thread0.num.queries_ip_ratelimited=0
thread0.num.queries_cookie_valid=0
thread0.num.queries_cookie_client=0
thread0.num.queries_cookie_invalid=0
thread0.num.cachehits=881769
......

After looking through the stats data I decided to break the collection in to two parts, one for the stats and one for the histogram data. The stats data is easily converted in json with the following in-line nawk script wrapped in sh.

#!/bin/sh

unbound-control -c /var/unbound/unbound.conf stats | nawk '
BEGIN{
  print "["
}
NF{
  # split…