# Parameters and Options

> What each option of Convert-DNSDebugLogFile actually changes, when you need it, and the traps that are easy to walk into.

---

LLMS index: [llms.txt](/llms.txt)

---

This page explains the options in plain language and in the order you will typically need them. It is a guide, not a specification — the authoritative, always-current parameter list lives in the [command reference](../commands/convert-dnsdebuglogfile/) and in:

```powershell
Get-Help Convert-DNSDebugLogFile -Full
```

## The short version

```powershell
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log"
```

That single line already gives you sensible behaviour: both data and statistics files, semicolon delimiter, your machine's date format, header validation on, source log untouched. Everything below is fine-tuning.

| Option | Default | Change it when |
|---|---|---|
| `-InputFile` | *(required)* | always |
| `-OutputFile` | input path with `.csv` | you want output somewhere else |
| `-Delimiter` | `;` | your consumer expects comma, tab or pipe |
| `-ComputerName` | empty | you merge logs from more than one server |
| `-OutputType` | `Both` | you only want data, or only rollups |
| `-ContextFilter` | `All` | you only care about actual DNS traffic |
| `-InputCulture` | current culture | the log came from a server with another locale |
| `-OutputCulture` | current culture | a machine will read the CSV |
| `-NoDetailsParsing` | off | throughput matters more than packet internals |
| `-CompressOutput` | off | you archive or transfer the results |
| `-RemoveSourceFile` | off | scheduled cleanup, and you trust the output |
| `-SkipHeaderValidation` | off | the file is valid but the header is unusual |

## Input and output

### -InputFile

Path to the log to convert. Takes an array, and takes pipeline input — which is why this works:

```powershell
Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" | Convert-DNSDebugLogFile
```

`Get-ChildItem` emits objects with a `FullName` property, and `-InputFile` accepts it by property name (its aliases include `FullName`, `Path`, `FilePath`). No `ForEach-Object` needed.

Local paths and SMB/UNC paths both work:

```powershell
Convert-DNSDebugLogFile -InputFile "\\dc01\C$\Administration\Logs\DNSServer\dns.log"
```

The command can also open a log that DNS Server currently holds open. See [active logs](#active-logs) below before you rely on that.

### -OutputFile

Without it, the CSV lands next to the input file, same base name, `.csv` extension. With it, you control the target.

<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">It must be a file path, not a folder</div>


`-OutputFile "D:\Processed\"` does not mean "write into this folder". Give the full path including the file name: `-OutputFile "D:\Processed\dns_data.csv"`.

This also means `-OutputFile` does not make sense when you pipe many files in — every conversion would write to the same target. For batch runs, leave it off and let each log produce its own CSV.
</div>


### -Delimiter

Default is a semicolon, because in locales where the comma is the decimal separator that is what Excel expects. Use `-Delimiter ","` for tools and databases that assume classic comma-separated values, or `` -Delimiter "`t" `` for tab.

Whatever you pick, use the *same* value on the import side. A mismatch is the number one cause of "everything ended up in one column".

## Labelling and filtering

### -ComputerName

Fills the `ComputerName` column. The column exists either way; this just gives it a value.

```powershell
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ComputerName $env:COMPUTERNAME
```

<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">This is not a remoting parameter</div>


Despite the name (and the `-Server` / `-DNSServer` / `-HostName` aliases), `-ComputerName` does **not** connect to anything. There is no WinRM, no remote execution. It only writes a label into the output. To read a remote log, point `-InputFile` at a UNC path.
</div>


Always set it when several servers feed one dataset — otherwise you cannot tell afterwards which DC a row came from.

### -OutputType

- `CSV` — data file only
- `Statistic` — the two aggregate files only, no row-level data
- `Both` — all three files *(default)*

`Statistic` is the fast, small option when you only need daily trends. `CSV` is right when a downstream system does its own aggregation.

### -ContextFilter

A DNS debug log mixes actual query traffic with server-internal chatter. `-ContextFilter` decides what survives into the output.

```powershell
# only real DNS traffic
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ContextFilter Packet

# traffic plus server events, but no diagnostic notes
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ContextFilter Packet, Event
```

| Value | Contains |
|---|---|
| `All` | everything *(default)* |
| `Packet` | DNS queries and responses — the data most analyses need |
| `Event` | server events, e.g. "The DNS server has started" |
| `Note` | diagnostic notes and warnings, e.g. socket errors |

Additional context types (`DSPoll`, `Init`, `Lookup`, `Recurse`, `Remote`, `Tombstone`) appear under `All`.

Filtering to `Event` or `Note` only populates `DateTime`, `ThreadId`, `Context` and `Information` — the protocol columns stay empty because those entries simply do not carry that information.

`-ContextFilter Packet` is the usual choice for security and reporting pipelines: it removes the noise and shrinks the output noticeably.

## International logs

DNS Server writes timestamps in the Windows locale of the machine it runs on. A German DC writes `20.01.2026 23:00:16`; a US server writes `1/20/2026 11:00:16 PM`. If your workstation's locale differs from the server's, parsing goes wrong — or, worse, silently swaps day and month.

### -InputCulture

Tell the parser which locale the *source log* uses:

```powershell
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns-berlin.log" -InputCulture 'de-DE'
```

| Culture | Log timestamp format |
|---|---|
| `de-DE` | `DD.MM.YYYY HH:MM:SS` |
| `en-US` | `M/D/YYYY H:MM:SS AM/PM` |
| `en-GB` | `DD/MM/YYYY HH:MM:SS` |
| `sv-SE` | `YYYY-MM-DD HH:MM:SS` |

Default is the culture of the session running the command. In a mixed-locale estate, set it explicitly rather than relying on that default — and remember that a scheduled task running as `SYSTEM` may not have the culture you tested with interactively.

### -OutputCulture

Controls how timestamps are *written* to the CSV:

```powershell
# ISO-like output that SQL Server, Power BI and pandas all understand
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputCulture 'sv-SE'

# same effect, explicit invariant culture
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" `
    -OutputCulture ([System.Globalization.CultureInfo]::InvariantCulture)
```

Rule of thumb: if a human opens the file in Excel, match the local culture. If a machine reads it, use `sv-SE` or invariant culture and stop worrying about regional settings on the import side.

The two parameters are independent — you can read a Swedish log and write US-formatted output.

## Speed and storage

### -NoDetailsParsing

If the DNS server logs full packet details, the parser turns each detail block into JSON in the `Details` column. That is useful, but it is also the most expensive part of the run and it inflates the CSV.

```powershell
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -NoDetailsParsing
```

The column stays present but empty; the TCP/UDP detail header line is still available in `Information`. On logs rich in detail blocks this can cut processing time by 30–50 %. Use it whenever query-level information is enough.

### -CompressOutput

Zips the generated CSV files and deletes the uncompressed ones. `dns.log` produces `dns.zip` instead of `dns.csv`.

```powershell
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -CompressOutput
```

CSV of this shape typically compresses by 90 % or more, so this is close to free storage savings for archives and for shipping files across the network.

### -RemoveSourceFile

Deletes the source `.log` after a successful conversion — the log is only removed if all output files were created.

```powershell
Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -CompressOutput -RemoveSourceFile
```

<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">Deletion is permanent</div>


There is no recycle bin here. Validate your output on real logs before you enable this in a scheduled job, and never point it at an active log file.

The command deliberately refuses to combine `-RemoveSourceFile` with `-SkipHeaderValidation`, so you cannot delete a file that was never confirmed to be a DNS log.
</div>


## Safety nets

### -SkipHeaderValidation

By default the command checks that the file really is a DNS Server debug log before parsing it. This catches the classic mistake of pointing the job at the wrong folder.

Switch it off only for genuinely unusual cases: hand-edited logs, pre-filtered extracts, custom formats. Keep it on everywhere else — it is cheap and it is what stands between a typo and a pile of garbage rows.

### -WhatIf and -Confirm

The command supports both. `-WhatIf` is the right way to see what a new batch job would touch:

```powershell
Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" |
    Convert-DNSDebugLogFile -RemoveSourceFile -WhatIf
```

`-Confirm` prompts before processing each file, before deleting a source file, and before overwriting existing output.

## Active logs

`Convert-DNSDebugLogFile` can read a file that DNS Server has open. Handy for an ad-hoc look at what is happening right now.

<div class="alert alert-warning" role="alert"><div class="h4 alert-heading" role="heading">Not for scheduled or production runs</div>


An active log changes while it is being read. The output may miss entries written during the conversion and its last record may be truncated. Repeating the run gives a different result.

For reproducible output, enable log rollover on the DNS server and convert only closed, rotated files — for example by skipping the newest one:

```powershell
Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -Skip 1 |
    Convert-DNSDebugLogFile -ComputerName $env:COMPUTERNAME
```
</div>


## Putting it together

A typical production invocation on a domain controller:

```powershell
Get-ChildItem "C:\Administration\Logs\DNSServer\*.log" |
    Sort-Object LastWriteTime -Descending |
    Select-Object -Skip 1 |
    Convert-DNSDebugLogFile `
        -ComputerName $env:COMPUTERNAME `
        -Delimiter ';' `
        -OutputType Both `
        -ContextFilter Packet `
        -OutputCulture 'sv-SE' `
        -CompressOutput
```

Read as: take every rotated log except the active one, keep only DNS traffic, label each row with the server name, write machine-readable timestamps, and leave compressed archives behind. The full scheduled-task and Group Policy version of this is in the [GPO-driven collection example](../examples/gpo-driven-collection/).