Parameters and Options

What each option of Convert-DNSDebugLogFile actually changes, when you need it, and the traps that are easy to walk into.

For AI agents: a documentation index is available at /llms.txt; a markdown version of this page is available at /docs/03-parameters-and-options/index.md.

This page explains the options in plain language and in the order you will typically need them. It is a guide, not a specification — the authoritative, always-current parameter list lives in the command reference and in:

Get-Help Convert-DNSDebugLogFile -Full

The short version

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log"

That single line already gives you sensible behaviour: both data and statistics files, semicolon delimiter, your machine’s date format, header validation on, source log untouched. Everything below is fine-tuning.

Option	Default	Change it when
`-InputFile`	(required)	always
`-OutputFile`	input path with `.csv`	you want output somewhere else
`-Delimiter`	`;`	your consumer expects comma, tab or pipe
`-ComputerName`	empty	you merge logs from more than one server
`-OutputType`	`Both`	you only want data, or only rollups
`-ContextFilter`	`All`	you only care about actual DNS traffic
`-InputCulture`	current culture	the log came from a server with another locale
`-OutputCulture`	current culture	a machine will read the CSV
`-NoDetailsParsing`	off	throughput matters more than packet internals
`-CompressOutput`	off	you archive or transfer the results
`-RemoveSourceFile`	off	scheduled cleanup, and you trust the output
`-SkipHeaderValidation`	off	the file is valid but the header is unusual

Input and output

-InputFile

Path to the log to convert. Takes an array, and takes pipeline input — which is why this works:

Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" | Convert-DNSDebugLogFile

Get-ChildItem emits objects with a FullName property, and -InputFile accepts it by property name (its aliases include FullName, Path, FilePath). No ForEach-Object needed.

Local paths and SMB/UNC paths both work:

Convert-DNSDebugLogFile -InputFile "\\dc01\C$\Administration\Logs\DNSServer\dns.log"

The command can also open a log that DNS Server currently holds open. See active logs below before you rely on that.

-OutputFile

Without it, the CSV lands next to the input file, same base name, .csv extension. With it, you control the target.

It must be a file path, not a folder

-OutputFile "D:\Processed\" does not mean “write into this folder”. Give the full path including the file name: -OutputFile "D:\Processed\dns_data.csv".

This also means -OutputFile does not make sense when you pipe many files in — every conversion would write to the same target. For batch runs, leave it off and let each log produce its own CSV.

-Delimiter

Default is a semicolon, because in locales where the comma is the decimal separator that is what Excel expects. Use -Delimiter "," for tools and databases that assume classic comma-separated values, or -Delimiter "`t" for tab.

Whatever you pick, use the same value on the import side. A mismatch is the number one cause of “everything ended up in one column”.

Labelling and filtering

-ComputerName

Fills the ComputerName column. The column exists either way; this just gives it a value.

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ComputerName $env:COMPUTERNAME

This is not a remoting parameter

Despite the name (and the -Server / -DNSServer / -HostName aliases), -ComputerName does not connect to anything. There is no WinRM, no remote execution. It only writes a label into the output. To read a remote log, point -InputFile at a UNC path.

Always set it when several servers feed one dataset — otherwise you cannot tell afterwards which DC a row came from.

-OutputType

CSV — data file only
Statistic — the two aggregate files only, no row-level data
Both — all three files (default)

Statistic is the fast, small option when you only need daily trends. CSV is right when a downstream system does its own aggregation.

-ContextFilter

A DNS debug log mixes actual query traffic with server-internal chatter. -ContextFilter decides what survives into the output.

# only real DNS traffic
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ContextFilter Packet

# traffic plus server events, but no diagnostic notes
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ContextFilter Packet, Event

Value	Contains
`All`	everything (default)
`Packet`	DNS queries and responses — the data most analyses need
`Event`	server events, e.g. “The DNS server has started”
`Note`	diagnostic notes and warnings, e.g. socket errors

Additional context types (DSPoll, Init, Lookup, Recurse, Remote, Tombstone) appear under All.

Filtering to Event or Note only populates DateTime, ThreadId, Context and Information — the protocol columns stay empty because those entries simply do not carry that information.

-ContextFilter Packet is the usual choice for security and reporting pipelines: it removes the noise and shrinks the output noticeably.

International logs

DNS Server writes timestamps in the Windows locale of the machine it runs on. A German DC writes 20.01.2026 23:00:16; a US server writes 1/20/2026 11:00:16 PM. If your workstation’s locale differs from the server’s, parsing goes wrong — or, worse, silently swaps day and month.

-InputCulture

Tell the parser which locale the source log uses:

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns-berlin.log" -InputCulture 'de-DE'

Culture	Log timestamp format
`de-DE`	`DD.MM.YYYY HH:MM:SS`
`en-US`	`M/D/YYYY H:MM:SS AM/PM`
`en-GB`	`DD/MM/YYYY HH:MM:SS`
`sv-SE`	`YYYY-MM-DD HH:MM:SS`

Default is the culture of the session running the command. In a mixed-locale estate, set it explicitly rather than relying on that default — and remember that a scheduled task running as SYSTEM may not have the culture you tested with interactively.

-OutputCulture

Controls how timestamps are written to the CSV:

# ISO-like output that SQL Server, Power BI and pandas all understand
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputCulture 'sv-SE'

# same effect, explicit invariant culture
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" `
    -OutputCulture ([System.Globalization.CultureInfo]::InvariantCulture)

Rule of thumb: if a human opens the file in Excel, match the local culture. If a machine reads it, use sv-SE or invariant culture and stop worrying about regional settings on the import side.

The two parameters are independent — you can read a Swedish log and write US-formatted output.

Speed and storage

-NoDetailsParsing

If the DNS server logs full packet details, the parser turns each detail block into JSON in the Details column. That is useful, but it is also the most expensive part of the run and it inflates the CSV.

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -NoDetailsParsing

The column stays present but empty; the TCP/UDP detail header line is still available in Information. On logs rich in detail blocks this can cut processing time by 30–50 %. Use it whenever query-level information is enough.

-CompressOutput

Zips the generated CSV files and deletes the uncompressed ones. dns.log produces dns.zip instead of dns.csv.

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -CompressOutput

CSV of this shape typically compresses by 90 % or more, so this is close to free storage savings for archives and for shipping files across the network.

-RemoveSourceFile

Deletes the source .log after a successful conversion — the log is only removed if all output files were created.

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -CompressOutput -RemoveSourceFile

Deletion is permanent

There is no recycle bin here. Validate your output on real logs before you enable this in a scheduled job, and never point it at an active log file.

The command deliberately refuses to combine -RemoveSourceFile with -SkipHeaderValidation, so you cannot delete a file that was never confirmed to be a DNS log.

Safety nets

-SkipHeaderValidation

By default the command checks that the file really is a DNS Server debug log before parsing it. This catches the classic mistake of pointing the job at the wrong folder.

Switch it off only for genuinely unusual cases: hand-edited logs, pre-filtered extracts, custom formats. Keep it on everywhere else — it is cheap and it is what stands between a typo and a pile of garbage rows.

-WhatIf and -Confirm

The command supports both. -WhatIf is the right way to see what a new batch job would touch:

Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" |
    Convert-DNSDebugLogFile -RemoveSourceFile -WhatIf

-Confirm prompts before processing each file, before deleting a source file, and before overwriting existing output.

Active logs

Convert-DNSDebugLogFile can read a file that DNS Server has open. Handy for an ad-hoc look at what is happening right now.

Not for scheduled or production runs

An active log changes while it is being read. The output may miss entries written during the conversion and its last record may be truncated. Repeating the run gives a different result.

For reproducible output, enable log rollover on the DNS server and convert only closed, rotated files — for example by skipping the newest one:

Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -Skip 1 |
    Convert-DNSDebugLogFile -ComputerName $env:COMPUTERNAME

Putting it together

A typical production invocation on a domain controller:

Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -Skip 1 |
    Convert-DNSDebugLogFile `
        -ComputerName $env:COMPUTERNAME `
        -Delimiter ';' `
        -OutputType Both `
        -ContextFilter Packet `
        -OutputCulture 'sv-SE' `
        -CompressOutput

Read as: take every rotated log except the active one, keep only DNS traffic, label each row with the server name, write machine-readable timestamps, and leave compressed archives behind. The full scheduled-task and Group Policy version of this is in the GPO-driven collection example.