To do your job well, you need the right information at the right time. Unfortunately, DNS query analytics live in a mess of disconnected backlogs and reports.

Now you can request real-time information for all of your domains at the push of a button. Real-Time Stats, or RTS, run query analytics every ten minutes, ensuring you always have up to the minute data for your domains.

dns screen

Identify, Troubleshoot, Mitigate

Immediately identify traffic abnormalities from 16 locations around the world.

This innovative tool streamlines the troubleshooting process, letting you quickly develop an actionable solution. View detailed information about how much traffic each network location is receiving in real time.

You can filter your RTS by:

  • Domain
  • Resource Record
  • Location
  • Time Frame
  • IP Version
  • Protocol
  • IP Filter
  • GeoProximity

RTS: The Future of Big Data Analytics

Learn how we are harnessing the power of Big Data to fuel our analytics and predict DDoS attacks.


Read More

Advanced RTS

We are now able to offer advanced RTS functionality, which allows you to increase the window of time you can view in your RTS reports. Keep in mind that the longer the time period is, the less granular the data will be. Rather than seeing intervals at every 5 minutes, you will see query data at hourly intervals.

  • Small Business and Business users can view query logs up to 45 days
  • Corporate clients can view query logs up to 62 days
dns screen

Coming Soon

Real-Time Logging

View domains with the largest number of queries

Send query logs to 3rd party storage

Set alerts when query rates increase above historical thresholds

Download historical query data

and much more...

How to Use RTS

rts get started

Inital Download

When you first open RTS, the initial load will be in Chart View. The Chart View Dashboard will display the top five time series: the number of queries your domain has received over a 5 day period.

This initial download will provide you with a quick overview of all of your queries by location. Any abnormal spikes will appear here, letting you know as soon as possible if there are regional issues that need to be resolved.

Orientation

Before we dive into the tutorials, we'd like to define a few terms so that we have a common language when using RTS.

filter

Time Series

A set of points that count as a function of time. In the initial download in chart view, each time-series is represented by a set of queries for a particular location.

filter

Dimensions

Location, record type, and/or record name are the “dimensions” of a bucket.

filter

Roll Up By

You can “roll up” the different dimensions to remove them from the chart by checking the box next to that dimension.

filter

Bucket

When dimensions have specific values, they become a bucket (a collection of dimensions). Each bucket becomes a plot on the graph.

Now that we have a common language, let's move on to how we can use RTS to analyze our query data. There are two different ways to view queries. We recommend you start with the Chart View, then move on to the Tabular View.

Chart View

The Chart View Dashboard will display the top five time series: the number of queries your domain has received over a 5 day period.

Each time-series in the chart shows the “time history” of queries received at that particular location.Time series are color-coded by location (PoP) within our network. You can see which color represents which location in the legend below the chart.

Because domains incur so many queries even within just a few minutes, each data point within a time-series represents the number of queries your domain received at that location over a 30-minute interval.

Legend of Symbols Used in RTS

◊ = Root Record

* = Wild Card Record Name

# = NX Domain Record Name

∑ = Aggregated Value in the Table

The date range control allows you to select how much historical data will load. RTS stores you historical data as far back as 30-days.


Date Range

The Time Series drop-down allows you to select the number of time series to display in the Chart. Time series are sorted by the most number of queries received with the time frame.

Time Series

Filters allow you to select and view only data that matches the filter you have selected. For example, if we click on the Location checkbox, and then select Los Angeles from the drop down, only queries from Los Angeles will be displayed. Or if you click on the Record Type checkbox, and then select the Record Type, A, from the drop down, only queries from San Jose for A records will be displayed.

You can combine multiple filters, but only one type of each filter can be chosen at a time. For example, you can Filter by Location: Ashburn, VA and Record Type: A Records. But you cannot filter by Location: Ashburn, VA and Location: Seattle, WA.

Filters

If you click on the Location checkbox, and select Los Angeles from the drop down, the chart will only display queries from Los Angeles.

Filters

The "Roll-Up By" feature allows you to combine time series. For example, if you click the "All" checkbox, then all the Time series will be combined and the Chart will show the total number of queries, as a function of time, that your domain received over your selected time frame. If you're following along, please unselect the "All" checkbox to show all the Time series.


Roll up by

You can also combine multiple time series together by selecting the dimensions you want to see together. For example: select only the "Record Type" and "Record Name" checkboxes. Now all the record types and record names will be combined, and the remaining Time series will only have location dimensions. Effectively, you are now seeing the queries received at each of the top five DNS Made Easy name servers locations. The legend at the bottom of the Chart will show the series only by location.

This is the same view you will remember from the initial download. That's because this view is quick to load and provides a general overview of your domain's query traffic.

Suppose that we want to see which records (Record Names) were queried at each location. Simply unselect the "Record Type" checkbox so that the roll-up is only by record type. Unselecting the "Record Type" checkbox requires Real-time stats to download more detailed data. Depending on the number of records composing your domain, this download can take 10 to 20 seconds or more. Once the data is loaded, the Chart will display the Time series for locations and record names.



Roll up by

We've seen how to display the total queries for your domain, the queries at each location, and the queries for record names at each location. Suppose that we would like to display the queries for your domain's record names. If we select the "Location" checkbox in the "Roll-Up By" section, what remains in the Chart are the time series for each record name in your domain.



Roll up by

Interacting with the Chart

If you mouse-over a data point of a time series, a pop-up window will display the start of the aggregation time interval. The pop-up will also display the number of queries for that time series received in that time interval. Notice that when you mouse over a data point, the mouse cursor changes from a double-sided arrow to a hand.


Interacting with the Chart

When you hover over an item in the legend, it will highlight the associated time-series and fade out the rest. This is really helpful if you are trying to troubleshoot specific issues by location or other filters.


Interacting with the Chart

We've just seen that by mousing over the name of a time series in the legend, we can highlight that time series. If we instead click on the name of the time series in the legend, then that time series will be hidden from the Chart. You can hide as many time series as you wish. To display a hidden time series, click it again.


Interacting with the Chart

For this function, you will need a mouse with a scroll wheel. If you do, then move the mouse cursor onto the Chart. When the mouse cursor changes to a double-sided arrow, you can turn your mouse wheel (our make the scroll gesture on a trackpad or magic mouse), the Chart will zoom around the cursor's location. By placing the mouse cursor over areas of interest, you can zoom in and out of any time on the Chart.


Interacting with the Chart

Tabular View

The "Tabular Data" tab will open with a summary table that displays all of the time series. Each time series will show the total number of queries, as well as the minimum and maximum number of queries received during any of the aggregation intervals.


NOTE: If you wish to view aggregated data in the Tabular data tab, please first perform your desired roll-ups on the chart tab.

Interaction with Tables

The table will initially show only 15 time series, sorted by the total number of queries. You can adjust this number by clicking the drop-down list on the top left-hand side of the table. You can choose to show: 15, 50, 250, 1000, and All time-series in the table.


Time Series

On the bottom left-hand side of the table, you should see the index range of the currently displayed time series, and the total number of time series the application has loaded. The control on the bottom right-hand side of the table will help you navigate through the time series one page at a time.

If you click on the "Next" button, the table will show the next page of time series. Clicking on "Previous" will cause the table to show the previous set of time series, if available. Clicking on any of the numbers will cause the table to display that page of time series.

Time Series

The text box on the top right-hand side of the table, labeled "Search:" provides a convenient method for filtering time series. For example, if you type "AAAA", then only time series that have "AAAA" text in the values of their dimensions (i.e. location, record type, or record name containing an AAAA) will be displayed.

Searching Table

If you would like to search for more than one word, you can type a space between the search words. Only time series that have all the space-separated words will be displayed. For example, if we type "AAAA ns10″ into the search box, then the table will only display the only 13 time series that contain both "AAAA" and "ns10″.

Searching Table

The table-level search is very useful for quick searches, but suppose that you want to view the total queries for each location. Recall from our earlier discussion that to view the total queries received at all locations means that the other two dimensions (Record Name and Record Type) have to be rolled-up.

You may have noticed a text box at the bottom of each column. For example, the "Location" column has a text box at the bottom of its column that holds the default text "Search Location". In our example, we will type the "∑" symbol into the search text boxes at the bottom of the "Record Name" and "Record Type" columns. And now we see each "Location" and the total number of queries at that location.



Filtering


Suppose we want to see the total number of queries for each record name. Then we place the "∑" symbol in the text box at the bottom of the "Location" and "Record Type" columns.



Filtering


Although we use the ∑ symbol in our examples, you can type any text you like into these search boxes.


The "∑" symbol displayed in a table column means that the dimension has been "Rolled-up By". When all the search terms are removed, you may notice that the first time series in the table has the ∑ symbol in each of the three dimensions: location, record type, and record name. This time series represents the total of all the time series. Recall from our previous discussion that when we roll-up by all the dimensions, we are combining all of the time series. Interestingly, the "Total Queries" for this time series is the total number of queries your domain received during the requested time-window.)

Suppose that we have filtered our time series so that we are displaying the queries for each location.But now we would like to see the individual data points for the time series representing all the queries received by our Hong Kong name server. Click on the green "+" symbol next to the location name. This will open a chart of that time series, and below it, a table that shows the number of queries received in each of the aggregation intervals.



View Details of a Particular Time Series

This sub-table provides the same navigation and paging behavior as the main table.

Start Using Constellix Today & Only Pay for What You Use!


GET STARTED