technohim/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

grafana: expose phone LDAP DNS root cause

Browse Source 
Verbose Yealink traces show LDAP binds fail before authentication because the provisioned short hostname SERVERPDC cannot be resolved. The failures started before the separate AD unauthenticated-bind hardening, so credentials and that security change are not the cause.\n\nInclude the explicit domain-resolution signature in current-state, trend, top-phone, and operational-log queries. Update panel guidance to direct investigation toward a resolvable LDAP FQDN or stable IP.\n\nThe added LogQL alternative was executed successfully against production Loki 3.7.2.
This commit is contained in:
pipistrello
2026-07-17 14:25:30 +03:00
parent 1a42f89c11
commit a4aa0e90fe
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
logging/grafana-dashboards/yealink-phones.json
+9 -9
View File
@@ -78,7 +78,7 @@
{
"type": "stat",
"title": "Active LDAP failures (15m)",
"description": "Distinct phones that could not bind/contact the LDAP directory in the last 15 minutes. This can break directory search and caller-name lookup, but does not by itself indicate a SIP calling outage.",
"description": "Distinct phones that could not resolve or contact the LDAP directory in the last 15 minutes. Verbose evidence identifies short-name DNS resolution of SERVERPDC as the cause. This can break directory/caller-name lookup, but not SIP calling itself.",
"gridPos": { "h": 4, "w": 4, "x": 8, "y": 5 },
"id": 3,
"datasource": { "type": "loki", "uid": "${datasource}" },
@@ -86,7 +86,7 @@
{
"refId": "A",
"datasource": { "type": "loki", "uid": "${datasource}" },
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server\" [15m])))",
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server\" [15m])))",
"queryType": "instant"
}
],
@@ -178,7 +178,7 @@
{
"type": "bargauge",
"title": "Phones by operational-signal events",
"description": "Top phones for the narrow signals this dashboard can interpret: LDAP connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. Keyed on MAC so DHCP changes do not split identity.",
"description": "Top phones for the narrow signals this dashboard can interpret: LDAP DNS/connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. Keyed on MAC so DHCP changes do not split identity.",
"gridPos": { "h": 9, "w": 12, "x": 0, "y": 9 },
"id": 7,
"datasource": { "type": "loki", "uid": "${datasource}" },
@@ -186,7 +186,7 @@
{
"refId": "A",
"datasource": { "type": "loki", "uid": "${datasource}" },
"expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\" [$__range])))",
"expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\" [$__range])))",
"queryType": "instant",
"legendFormat": "{{mac}}"
}
@@ -227,7 +227,7 @@
{
"type": "timeseries",
"title": "Operational signals over time",
"description": "Narrow, interpretable signals separated from firmware error-severity noise. LDAP affects directory lookup; internal DB affects local apps; provisioning should settle after boot; SIP DNS timeouts can prevent registration.",
"description": "Narrow, interpretable signals separated from firmware error-severity noise. LDAP short-name DNS failure affects directory lookup; internal DB affects local apps; provisioning should settle after boot; SIP DNS timeouts can prevent registration.",
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 18 },
"id": 9,
"datasource": { "type": "loki", "uid": "${datasource}" },
@@ -235,7 +235,7 @@
{
"refId": "A",
"datasource": { "type": "loki", "uid": "${datasource}" },
"expr": "sum(count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server\" [$__interval]))",
"expr": "sum(count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server\" [$__interval]))",
"queryType": "range",
"legendFormat": "LDAP directory"
},
@@ -310,7 +310,7 @@
{
"type": "logs",
"title": "Operational signals — investigate these first",
"description": "LDAP connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. LDAP affects directory features but not calls; provisioning bursts during reboot are expected unless they persist. Labels show stable MAC and current source IP.",
"description": "LDAP DNS/connectivity, internal database faults, provisioning/download failures, and SIP DNS timeouts. LDAP affects directory features but not calls; verbose phones identify SERVERPDC short-name resolution as the current LDAP cause. Labels show stable MAC and current source IP.",
"gridPos": { "h": 10, "w": 24, "x": 0, "y": 26 },
"id": 11,
"datasource": { "type": "loki", "uid": "${datasource}" },
@@ -318,7 +318,7 @@
{
"refId": "A",
"datasource": { "type": "loki", "uid": "${datasource}" },
"expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\"",
"expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"Domain name resolution failed|ldap_sasl_bind_s|Can't contact LDAP server|database disk image is malformed|Null Virtual Machine pointer|Invalid scalar query|tftp to file failed|no config Provisioning Server|DURL<3[+]error|Timeout while contacting DNS servers\"",
"queryType": "range"
}
],
@@ -458,6 +458,6 @@
"timezone": "browser",
"title": "Yealink IP phones — syslog health",
"uid": "yealink-phones",
"version": 3,
"version": 4,
"weekStart": ""
}