Many PTR DNS queries

Icinga 2
1

Hi,

we are running an icinga2 cluster with >1.5k hosts monitored. I was tracing down a different issue with our dns when I found out that icinga2 resolves the PTR record to every IP address it gets. This ends in thousands of SERVFAILS per minute.
When there is a hostname in “address” it resolves A first, then AAAA and then PTR to the A record. When there is an IP it only resolved PTR.

Is this a feature or a bug?

# icinga2 --version
icinga2 - The Icinga 2 network monitoring daemon (version: r2.11.3-1)

Copyright (c) 2012-2021 Icinga GmbH (https://icinga.com/)
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl2.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
  Platform: Debian GNU/Linux
  Platform version: 9 (stretch)
  Kernel: Linux
  Kernel version: 4.9.0-12-amd64
  Architecture: x86_64

Build information:
  Compiler: GNU 6.3.0
  Build host: runner-LTrJQZ9N-project-298-concurrent-0

Application information:

General paths:
  Config directory: /etc/icinga2
  Data directory: /var/lib/icinga2
  Log directory: /var/log/icinga2
  Cache directory: /var/cache/icinga2
  Spool directory: /var/spool/icinga2
  Run directory: /run/icinga2

Old paths (deprecated):
  Installation root: /usr
  Sysconf directory: /etc
  Run directory (base): /run
  Local state directory: /var

Internal paths:
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

# icinga2 feature list

**Disabled features:** compatlog debuglog elasticsearch gelf graphite icingastatus influxdb livestatus opentsdb perfdata statusdata

**Enabled features:** api checker command ido-mysql mainlog notification syslog
2

Hi and welcome!

Look into this thread: Simple question about ip address vs hostname and dns for pings. Your question is similar.

In short: It’s difficult to give a general answer. The point is, that Icinga only triggers external check plugins and pass the necessary from the check command definition. If you pass the dns name, the triggerd check plugin (not Icinga!) you’ve defined in the service, has do lookup the dns. Maybe the check plugin you are using has it’s own mechanism or it is using the TCP/IP stack of the OS.
After the check plugin did his job, it passes the result back to Icinga.