Discuss BlueCat products

Will be checking this in the lab later this week but looking for opinions. Pertinent to my other post related to cert renewal issues..  Exploring a work around where we would define laptop’s primary connection suffix via GPO. There are non-MS clients on the same networks so we have to continue to hand out the DNS / DDNS domain deployment options.I’m wondering assuming we’re already configured in BC with those options and then do the same in GPO, which one wins / is persistent?Thanks!

Good evening, As the powers that be push us towards shorter and shorter certificate durations, large enterprise grapples with certificate management . We were previously using Microsoft native for workstations / servers / laptops which was working ok with a few shortcomings.The responsible team looked at other ‘enterprise’ solutions and ultimately picked Venafi by Palo (previously CyberArk). We have run into a seemingly insurmountable issue impacting only laptops that roam between sites that have differing deployment options for the DNS and DDNS zone names. I.E. Execs travel to hospitals or local managers travel to system office, etc.At it’s home site, the device gets a zone name (via deployment option) of acme.com (the parent). The device gets it’s cert and all is good with a FQDN of device123.acme.com. Device then travels to the Ann Arbor site and is handed a deployment option for the zone of aa.acme.com.Now the fun starts: Device cert happens to expire while at remote site and attem

Hello, I started in 2008 with Bluecat. I requested many times to get the ability to manage VLAN in BAM. I am now in a migration from Efficient IP and also Infoblox. Both competitors support VLAN management, but Integrity NOT. For me it is a big challenge to try to implement VLAN Management into BAM, using Device and User defined Links. but this is not a good solution, it is like a Workaround to avoid the customer using back a Excel Sheet.Integrity integrates more and more with the network. WHY does Integrity still not support VLAN Management? Any comment is welcome to force Bluecat look at the feature for the next release.Pascal

We are excited to announce the release of BlueCat Integrity 26.1, the next evolution of our DDI platform. Building on the foundation established with Integrity X, this release expands beyond core DNS, DHCP, and IP Address Management to deliver greater visibility, automation, and operational intelligence across your network infrastructure.Integrity 26.1 is designed to help organizations accelerate operations, reduce manual effort, and gain deeper insight into increasingly complex hybrid and multi-cloud environments.Learn more

Here is my current API query from the api inline docs page (/api/v2/transactions): filtercreationDateTime:ge('2026-05-01T00:00:00Z') and creationDateTime:le('2026-06-01T00:00:00Z') and user.name:contains('system')This matches on system, NP.My issue is in the docs online for filtering, I can’t seem to locate anything about NEGATING the contains.In my case I want this query to exclude ‘system’ transactions.Thanks a million!

Is there documentation regarding how one authenticates to <address-manager-ip>:10048/metrics to access the Prometheus metrics exporter?  Running 25.1.2, it appears to be asking for/requiring a client certificate, but I can’t find any documentation about how one configures this.

We're looking to install another site with recursive and authoritative DNS. I’ve done some looking into the multi-primary function though unsure if this is what we're looking for. The goal is to have this site’s DNS/DHCP intact in a disaster scenario where the primary data center is down or unreachable. I am only finding instructions on how to setup multi-primary roles on new zones without existing primary roles. In my attempt to test this I was not able to use or add a new multi-primary role to existing zone as it complains there is already a primary role. Looks like you would have to remove the existing primary role to add the new role, though not sure of the impact here.Can a multi-primary DNS setup function if the BAM is unreachable? How do you install multi-primary roles on existing zones with little or no impact to clients? 

I want to automate adding my custom certificates in 9.6.x (and later 25.x).  I’ve found references to older versions of Integrity for file locations but have they changed in 9.6.x?  If so, which directory?

Integrity 26.1 Beta testing is still open! We’re currently running a beta program for Integrity 26.1 and there’s still time to get involved. Beta testers get early access to new features and the chance to make sure the things that matter to you work the way you expect.Here’s how to join:Request access by requesting to join the Integrity 26.1 beta group. Follow the instructions in the group and download the latest build (beta-2-candidate) from Dropbox Start testing and submit your feedbackThe program is actively ongoing and your feedback is already influencing fixes in real time. If you’re interested in testing the new ND&V module specifically, make sure to select that option when filling out the form.Questions? Drop them below or reach out to the beta team directly.Beta group: https://community.bluecatnetworks.com/groups/integrity-26-1-customer-beta-57

When perusing Global->Transactions, if you click white space in the table the fly-out window presents a barebones representation of the transaction (just an object id, no IP or Name or other object-identifying data).  It also lists an Operations heading, but there are never any Operations underneath it.  It took me awhile to figure out that there ARE actually operations present, but for some reason they are not presented in the fly-out window.  You have to instead click on the Transaction operation link in the table which then loads the transaction and lists the operations.  Is this a bug in that the fly-out window is not showing operations (despite there being an Operations section in the window)?  Or just non-intuitive working as designed? 

When searching for a Resource Record in the API, how can I limit it to a particular DNS View?  Or if I find all records, how can I tell which View each record belongs to?  The Configuration is included as a value in the object, but the View seems to be missing.  Do I have to climb the tree up to the view each time?  That would be several API calls for each and every record.

Hi everyone,We’re currently running the Integrity X 26.1 Beta and we are inviting interested Integrity users to participate.This beta gives you early access to v26.1.0 so you can test new capabilities in a UAT or lab environment and share feedback ahead of GA.What’s included in this release:Integrity Feature Modules within Address Manager Network Discovery & Visibility, Cloud Discovery & Visibility, and DDI Analytics EventBus API for real-time DDI event streaming Secure NTP (NTS) support JSON export + enhanced import capabilities Audit trail and platform improvementsThe beta is available through the NVIP Integrity X 26.1 Beta Group. Once approved, you’ll get access to:Announcements and updates Download instructions and documentation Direct engagement with Product Management A space to share feedback and questions👉 To join:Log into NVIP Navigate to the Integrity X 26.1 Beta Group Select Request to JoinNote:This beta is for test environments only (not production) ND&V, CD&am

Micetro is an extremely powerful orchestration tool. Providing a single GUI/API across disparate DNS & DHCP systems, together with discovery and IPAM. Giving that single pane of glass view into the entire network.This works great for centralising administration, audit logging plus wrapping around Role Based Access even for DNS and DHCP platforms that don’t natively support this. What isn’t necessarily fully appreciated (though I know some of our customers are doing this!) is how you can leverage the Micetro API, together with the DDI data Micetro has visibility into to help streamline Network provisioning. In order to highlight this, I’ve put together some sample Python code, built around the Micetro API to automate the provisioning of network interfaces on some VyOS devices.[ VyOS (https://vyos.io ) is an open source router/firewall. The command syntax is very similar to Junos OS] Although this example is written for VyOS I’ve tried to make the code easy to adapt for other platfor

I’ve been meaning to share this for a while…..One of the things that makes Micetro really useful when you start using it for Orchestration of your DNS and DHCP infrastructure is the centralised audit log for all DDI related changes. i.e. Who did what when!Normally this is only accessible via the Micetro GUI. However as the GUI is built on the API this can also be exposed using the GetHistory API command. In order to help illustrate this I’ve written a simple python script which can be run/scheduled from within Micetro which can read the audit log and send this to an external syslog server. Under the hood it uses the Python logger module which can support many other formats including HTTP and SMTP for example.https://github.com/worrabkram/audit2syslogPlease note…This is a personal project not linked to BlueCat.No warranty or support implied.Hopefully you find this usefulMark

Hi, I’am currently testing Openstack as a VMware alternative in my company. Under VMware, we currently use the Bluecat API to automatically reserve IP addresses and set DNS names. Is there a Openstack Adaptive Plugin / Neutron Driver from Bluecat with the same features?The article about the Adaptive Plugin only refers to “Openstack Train”, which is quite old and end-of-life since 2024:https://bluecatnetworks.com/integrations/openstack/I also found a GitHub page, but it hasn't been updated since 2018:https://github.com/bluecatlabs/bluecat-openstack-driversCan one of these still be used for a current Openstack version (2025.2 or newer), or does Bluecat offer another solution for automating IPAM in OpenStack?regardsMichael

Hi,i have a problem with my bind server. (Full disclosure, it’s not with my BDDS installation but a non-bluecat named server).When i try to resolve www.semigator.de thouth this server, it works fine. But  after some time, it stops working. It’s not a general Problem, other stuff is still possible to resolve. If i flush the cache, it instanstly works again. I have a suspiction why that is, but i wanted to check with someone. My setup is the following: I run the official docker hub image from isc (https://hub.docker.com/r/internetsystemsconsortium/bind) in v9.20. It runs on an RHEL 9.7 with docker-ce.x86_64 3:29.1.2-1.el9. The container runs it’s networking in host mode (so it attaches directly to port 53 of the OS).Important, i do not have any IPv6 IPs. Thus i overrule the entrypoint with the -4 Option:/usr/sbin/named -f -c /etc/bind/named.conf -u bind -4 When i inspect the cache after first resolving, the nameservers each have two IPs, an v4 and one v6. The v4 has a TTL of 3600, and th

Several years ago I asked BC about whether they would write/provide an octodns Provider module/plugin, to be on par on the dozen or so other Providers. E.g. Infoblox, Cloudfare, DigitalOcean, Route53 etc. See: https://github.com/octodns/octodns-route53 I was told: “No but we can quote you on a price”I wrote my own first using the v1 API then v2. I’ve recently put it up on github if others are interested.https://github.com/quistian/octodns-bluecatI’ve found octodns to be a very useful method to synchronize many authoritative DNS servers, using a central YAML data store.   

In certain contexts e.g. Azure Authoritative DNS Resource,  there is no granularity at the RR level.So given a larger institution have multiple groups using the same Azure Tenant,  there is no way to limi who can view/change/add RRs.  I.e. using the Azure Dashboard, which has a nice GUI where one can view RRs,  all users can see all the records. Question: Does RBAC help us solve the  problem, Given we have a one to one representation of our data in Integrity?Answer: To the best of my knowledge, No.A View combined with RBAC does not allow granularity down to the RR level.So do others have any solutions to this “problem”. I’ve used artificial subdomain names to branch out the ownership of different groups. E.g. in the case of Azure Resource Domain Names:privatelink.openai.azure.com.345 --→ Engineering Groupprivatelink.mysql.database.azure.com.1123 -→ Web Development and OperationsOne can also put the artificial group names at the other end of the FQDN and use more readable tokens:eng.pri

I’m curious if anyone can speak to what the limiting factors are on BAM’s ability to process notifications?  We’ve experienced some occurrences where it looks like the notification processing has hit a SQL block for a period of time, causing PNA file backlogs on the BAM.  Once the block clears, it takes BAM a certain amount of time to catch back up.  Observing the appliance while it does so, it seems a single postmaster process CPU-bound against a single thread - so depending on the size of the backlog it can take quite a bit of time to catch up, even though the BAM overall is 98% idle.This notification processing is really the only performance-related concern I currently have for our BAMs - and it would be awesome if  notification processing could be improved in such a way as to better consume the available hardware resources.

Are there any plans to support optimized bulk data export via the v2 API, such as was introduced with the v1 exportEntities method?  We have several integrations and reporting routines that depend on exportEntities and I’m trying to plan for when the v1 API goes away.Also, are there any plans to expand the CSV import functionality such that one can import IPv4/6 objects across multiple parents in one action?  Always needing to know the parent has always been a bit of a nag when working with the BAM API and this is still reflected in the UI CSV imports.  Any plans for CSV imports of additional object types?  Competing products’ abilities in the area of object import have a leg up on Bluecat in my experience.

Is there an ETA for integrating Micetro DNS services and Cloudflare? Thanks,Mark 

Anyone know why the swagger scheme lists “CANCEL” as the only enum for “status” on the endpoint?  I’m looking for all valid values and I know at minimum there are “DONE” and “FAILED” but the schema for some reason only lists CANCEL (and that seems to be true for all deployment types in the schema).  

Does anyone know what the requirements are for a BDDS to show up in the Visualization/Dashboards section with the new metrics?  I know it must be running 25.x, however I’ve added a new BDDS in my lab and it’s not showing up.  I performed the following sequence:BAM → upgraded from 25.1 to 25.1.1 (previous to 25.1 it was running 9.5.2).BDDS→ Added to BAM while the BDDS was running 9.5.2BDDS->Upgraded to 25.1.1BDDS does not show up in Visualization but shows connected to BAM and can receive deployments and otherwise operates normally.BAM->Disabled/enabled the BDDS, restarted BAM, disabled/replaced, deleted/readded the BDDS while it was running 25.1.1.  Stopped/started the metrics exporter service. Nothing I do seems to get it to show up.  It’s clearly getting filtered (like the rest of the BDDS’s running 9.x attached to this BAM) - but I can’t see why.  The API calls being made by the UI are returning the full list of servers. 

We are working on a script to read route tables and with some automatic enrichment and human validation, add missing IP Networks (as IP4Network/IP6Network objects) to Integrity. Since creating a network requires providing the parent IP Block ID, I am wondering what the ‘right’ way is to find the parent for a CIDR range that may or may not exist as an IP?Network already in the IPAM database.I have tried the following:filter=range:contains(“204.0.113.0/24”) - which errors (because ‘contains’ doesn’t work with CIDR)filter=range:contains(“204.0.113.0”) - where I just take the lowest IP in the CIDR range. This works but seems sub-optimal to me for some reason. Maybe because I can’t be sure if the block fits the entire CIDR, though that seems unlikely to be a real problem in practice.I have also tried various forms of range:le and range:ge but (as documented) they only match on the prefix length and protocol (determined based on whether the address is v4 or v6), and so is not useful in this

Is anyone else out there experiencing failures when building custom containers using either v25.1.0 or v25.1.1 as their dockerfile FROM sources?Example:0.372 Get:1 http://deb.debian.org/debian bullseye InRelease [75.1 kB] 0.454 Get:2 http://deb.debian.org/debian-security bullseye-security InRelease [27.2 kB] 0.497 Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.0 kB] 0.543 Ign:4 http://deb.debian.org/debian bullseye-backports InRelease0.581 Get:5 http://deb.debian.org/debian bullseye/main amd64 Packages [8066 kB]1.235 Get:6 http://deb.de