Output Formats

For AI agents: a documentation index is available at /llms.txt; a markdown version of this page is available at /docs/02-output-formats/index.md.

Convert-DNSDebugLogFile produces up to three files per input log:

Both is the default. Output lands next to the input file unless you set -OutputFile.

The sample files linked on this page are real conversion results, not mock-ups. Download one and open it in Excel before you commit to a pipeline design.

The CSV data file

Sample output:

Two rows from a real conversion — a DNS query and a server-internal note:

DateTime;ThreadId;Context;PacketId;Protocol;Direction;ClientIP;Xid;Type;Opcode;FlagsHex;FlagsChar;ResponseCode;QuestionType;QuestionName;Information;Details;ComputerName
2026-01-20 23:00:16;0FE0;Packet;000002C53117D990;UDP;Rcv;10.0.0.2;c049;Query;Standard;0001;RecursionDesired;NOERROR;A;"odc.officeapps.live.com";"";"";dc01
2026-01-20 23:00:16;DF0;Note;;;;;;;;;;;;"";"got GQCS failure on a dead socket context status=995, socket=904";"";dc01

Columns

Always 18 columns, always in this order:

Two things to plan around:

• Not every column is filled for every row. Only Packet entries have a client IP, a question name and a response code. Note and Event rows carry their text in Information and leave the protocol columns empty. Design your database schema and dashboard filters accordingly.
• ComputerName is always the last column, even when you do not use -ComputerName. It is then simply empty. This keeps the layout identical across all servers so you can concatenate files from many DNS servers without a column-mapping step.

The Details column

Detail blocks only appear if the DNS server is configured to log full packet details. When they exist, the parser converts them into a single JSON value so the row stays one row:

{
  "Socket": "848",
  "Remote": "addr 10.10.0.11, port 60580",
  "Buflength": "0x10000 (65536)",
  "Message": {
    "XID": "0x0001",
    "OPCODE": "0 (QUERY)",
    "RCODE": "0 (NOERROR)",
    "QUESTION": [ { "Name": "berlin.de", "QTYPE": "A (1)", "QCLASS": "1" } ],
    "ANSWER": []
  }
}

Parsing these blocks costs time and makes the CSV considerably larger. If you do not need them, use -NoDetailsParsing — the column stays present but empty, and conversion gets faster. See Performance.

The statistics files

Statistics are daily aggregates. Use them when you want a trend or a rollup and do not want to move the full record set around — they are orders of magnitude smaller than the data file.

Context statistics (*_Statistic.csv)

Answers: how much of what kind of activity happened per day?

Date;Context;Count;ComputerName
2026-01-20;Event;2;dc01
2026-01-20;Note;2;dc01
2026-01-20;Packet;12;dc01

Sample files: en-US WithComputerName, en-US NoComputerName, de-DE WithComputerName, de-DE NoComputerName

Packet statistics (*_PacketStatistic.csv)

Answers: who queried what, how often, per day?

Date;ClientIP;Protocol;Direction;QuestionType;Count;ComputerName
2026-01-20;10.0.0.1;UDP;Rcv;A;3;dc01
2026-01-20;10.0.0.1;UDP;Snd;A;3;dc01
2026-01-20;10.0.0.2;UDP;Rcv;A;3;dc01

Sample files: en-US WithComputerName, en-US NoComputerName, de-DE WithComputerName, de-DE NoComputerName

Delimiter and date format

Both output types respect -Delimiter (default ;) and -OutputCulture. For anything that will be imported by a machine, write ISO-like timestamps:

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputCulture 'sv-SE'

That yields 2026-01-20 23:00:16, which SQL Server, Power BI and pandas all read without a format hint. Details in Parameters and Options.