DNSServer.DebugLogParser on PowerShell module DNSServer.DebugLogParser

Overview

Mon, 01 Jan 0001 00:00:00 +0000

Windows DNS Server can write a debug log. It is a plain text file, it is meant to be read by a human, and it grows by hundreds of megabytes a day on a busy domain controller. That combination makes it nearly useless the moment you want to answer a question like “which client asked for this domain 40.000 times last night?”

DNSServer.DebugLogParser turns that text file into a CSV table. One log line becomes one row with named columns, so you can open it in Excel, load it into Power BI, bulk-insert it into SQL Server, or ship it to your SIEM.

Output Formats

Mon, 01 Jan 0001 00:00:00 +0000

Convert-DNSDebugLogFile produces up to three files per input log:

File	Contains	Created when
`<name>.csv`	One row per parsed log entry	`-OutputType CSV` or `Both`
`<name>_Statistic.csv`	Daily record count per context	`-OutputType Statistic` or `Both`
`<name>_PacketStatistic.csv`	Daily query count per client, protocol, direction and record type	`-OutputType Statistic` or `Both`

Both is the default. Output lands next to the input file unless you set -OutputFile.

The sample files linked on this page are real conversion results, not mock-ups. Download one and open it in Excel before you commit to a pipeline design.

Parameters and Options

Mon, 01 Jan 0001 00:00:00 +0000

This page explains the options in plain language and in the order you will typically need them. It is a guide, not a specification — the authoritative, always-current parameter list lives in the command reference and in:

Get-Help Convert-DNSDebugLogFile -Full

The short version

Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log"

That single line already gives you sensible behaviour: both data and statistics files, semicolon delimiter, your machine’s date format, header validation on, source log untouched. Everything below is fine-tuning.

Performance

Mon, 01 Jan 0001 00:00:00 +0000

DNS debug logs on a busy domain controller are big. Convert-DNSDebugLogFile is built for that case: it has been tested with logs of 100 MB and beyond, and it processes them in minutes on ordinary server hardware.

Why it is fast

You do not need to know any of this to use the module, but it explains the behaviour you will observe.

Technique	Effect you notice
`StreamReader` / `StreamWriter` with 64 KB buffers	The file is read and written in chunks instead of one big `Get-Content`
Streaming, single pass	Memory usage stays roughly flat no matter how large the log is
String operations (`.Substring()`, `.IndexOf()`) instead of regular expressions	Considerably less CPU per line, and there are millions of lines
CSV written by hand instead of `Export-Csv`	No object pipeline overhead per record
Hashtable-based aggregation for statistics	Rollups cost almost nothing extra during the same pass

The important consequence: the whole log is never held in memory. A 500 MB log does not need 500 MB of RAM. This is the difference between the module and the “read the file, split it, build objects” approach most home-grown scripts take — that approach works fine on a 5 MB sample and falls over on a real DC.

Integration with Analysis Tools

Mon, 01 Jan 0001 00:00:00 +0000

The point of converting a DNS debug log is what happens next. CSV was chosen because everything reads it — but “everything reads CSV” hides two settings that decide whether an import is painless or an afternoon of fiddling.

Two settings that decide everything

Delimiter. Default is ;. Keep it for Excel in locales that use the comma as decimal separator. Switch to , for most databases and data-science tooling. Whatever you choose, tell the importing side the same thing.

Operational Best Practices

Mon, 01 Jan 0001 00:00:00 +0000

Converting a log by hand is easy. Running it every night on every domain controller, for years, without anyone looking at it, is the part that needs a bit of design. These are the points that matter in practice.

1. Convert rotated logs, not the active one

Enable log rollover on the DNS server and convert only closed files. The module can read the log DNS Server is currently writing to, but that file changes underneath the conversion: the newest entries may be missing and the last record may be truncated. Two runs produce two different results.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

“The file is not a valid DNS debug log file”

The header check rejected the input. Usually the path is simply wrong — a .log file in the same folder that is not the DNS debug log, or a file that only contains a rotated header.

Work through this:

Open the file. A DNS debug log starts with a header line such as Message logging started at … and continues with timestamped query entries.

Convert-DNSDebugLogFile

Fri, 24 Jul 2026 00:00:00 +0000

SYNOPSIS

Transforms Windows DNS Server debug logs into structured CSV format for analysis and reporting.

SYNTAX

__AllParameterSets

Convert-DNSDebugLogFile [-InputFile] <string[]> [[-OutputFile] <string>] [[-Delimiter] <string>]
 [[-ComputerName] <string>] [[-OutputType] <string>] [[-ContextFilter] <string[]>]
 [[-InputCulture] <cultureinfo>] [[-OutputCulture] <cultureinfo>] [-SkipHeaderValidation]
 [-RemoveSourceFile] [-CompressOutput] [-NoDetailsParsing] [-WhatIf] [-Confirm]

ALIASES

This cmdlet has the following aliases,

Release notes v1.2.2.0 (2026-07-24)

Fri, 24 Jul 2026 00:00:00 +0000

Added

NEW: Support for reading DNS Server debug log files that are currently open by the DNS service
- Enables processing of active log files without requiring the file to be closed first
- Improves compatibility with logs that are still being written or held open by another process
- Be cautious when processing live logs, as records may be incomplete or in flux
NEW: Support for SMB/UNC paths when reading source log files
- Allows the parser to work with files stored on network shares and remote locations
- Improves reliability in centralized or shared storage environments

Changed

Module metadata: Updated ProjectUri and ReleaseNotes to point to the official website https://dnsserverdebuglogparser.andibellstedt.com for better discoverability and documentation access
Fixed File access: Updated the underlying file opening logic to use stream-based access with explicit options for shared read scenarios
- Improves handling of live log files and alternate path types such as UNC shares
- Maintains consistent behavior for local and remote file sources

Release notes v1.2.1.0 (2026-01-26)

Mon, 26 Jan 2026 00:00:00 +0000

Changed

Performance: Improved multi-line record processing to avoid loading large files into memory
- Prevents out-of-memory errors on very large log files
- Maintains full support for PACKET detail blocks and indented continuation lines
- Memory usage is now constant regardless of file size
Progress: Added Write-Progress for processing feedback
- Progress bar updates every 1000 records for minimal performance impact
- Displays current record count and file being processed

Release notes v1.2.0.0 (2026-01-25)

Sun, 25 Jan 2026 00:00:00 +0000

Added

NEW: Multi-line record processing for DNS PACKET detail blocks
- PACKET context entries can now include detailed TCP/UDP connection information and DNS message structure
- Detail blocks are parsed into structured JSON format in the new Details column
- Includes: Socket info, remote address/port, timing data, message structure (XID, Flags, QCOUNT, etc.)
- DNS sections (QUESTION, ANSWER, AUTHORITY, ADDITIONAL) are captured with full record details
- Encoded domain names in detail blocks are automatically converted to FQDN format
NEW: Details column in CSV output
- Contains structured JSON data for PACKET entries with detail blocks
- Empty for PACKET entries without details and all non-PACKET contexts
- Enables deep packet analysis and forensic investigation of DNS queries/responses
NEW: NoDetailsParsing switch parameter for performance optimization
- Skips expensive JSON parsing of PACKET detail blocks
- Can improve processing speed by 30-50% for logs with many detail blocks
- Use when processing very large files (100MB+) and detailed packet structure is not needed
- Detail blocks are still collected in Information column, but Details column remains empty
NEW: Multi-line continuation support for non-PACKET contexts
- EVENT, Note, DSPoll, and other contexts can now span multiple lines
- Indented continuation lines are automatically joined to the main record’s Information field
- Preserves complete error messages, zone updates, and diagnostic output
NEW: ContextFilter recognizes additional context types: DSPoll, Init, Lookup, Recurse, Remote, Tombstone
- Effect: Convert-DNSDebugLogFile can now include/exclude these diagnostic and lifecycle entries via -ContextFilter
NEW: Statistics output now includes two dedicated files
- _Statistic.csv: Daily record counts per context type (Date, Context, Count, ComputerName)
- _PacketStatistic.csv: Daily PACKET counts by client/protocol/direction/type (Date, ClientIP, Protocol, Direction, QuestionType, Count, ComputerName)
- Benefit: More focused reporting (operational context volume vs. DNS traffic breakdown)
JSON generation for PACKET detail blocks is optimized for performance (manual parsing instead of regex)

Changed

BREAKING: CSV output now includes 18 columns (added Details column before ComputerName)
- New column order: DateTime, ThreadId, Context, PacketId, Protocol, Direction, ClientIP, Xid, Type, Opcode, FlagsHex, FlagsChar, ResponseCode, QuestionType, QuestionName, Information, Details, ComputerName
- Impact: Scripts that rely on column positions must be updated
- Benefit: Rich packet analysis capabilities without changing existing Information column behavior
Data line processing refactored to read all lines into memory for efficient multi-line record detection
- Performance: Minimal impact due to optimized List usage
- Benefit: Enables accurate lookahead for detail blocks and continuation lines
Question names that are missing or encoded as empty are now handled gracefully (no parse errors); CSV output will contain an empty QuestionName field when absent

Improved

Convert-DNSDebugLogFile parsing is more resilient: stricter line validation and improved extraction reduce spurious/invalid rows from malformed logs while preserving the CSV/statistic output format
PACKET context detection distinguishes between simple queries and queries with detail blocks
Empty lines after PACKET entries without details are properly skipped
Domain name decoding in detail blocks uses existing ConvertTo-Fqdn function for consistency

Performance

Processing speed maintained for logs without detail blocks
NoDetailsParsing switch provides 30-50% speed improvement when JSON parsing is not needed
Efficient state management during multi-line record processing
Optimized string operations (TrimStart, Join) instead of regex for continuation line handling

Notes

These changes are designed to be backward compatible for normal usage. If you rely on an exact set of context names or previously-strict parsing behavior, please validate downstream scripts
The new Details column is always present in CSV output; use NoDetailsParsing to keep it empty for performance
Existing scripts that parse CSV by column position need to account for the new Details column (position 17, before ComputerName)

Release notes v1.0.0 (2026-01-23)

Fri, 23 Jan 2026 00:00:00 +0000

Added

Initial release
Convert-DNSDebugLogFile - High-performance parser for Windows DNS Server debug log files
Parses all 15 standard fields from DNS debug logs into structured CSV format
Supports customizable CSV delimiters (default: semicolon)
Optional ComputerName column for multi-server log consolidation
Three output modes: CSV data only, statistics only, or both
Statistical summaries aggregating activity by client IP, protocol, and query type
Pipeline support for batch processing multiple log files
Header validation to ensure data integrity (can be bypassed if needed)
Optional automatic compression of output files (ZIP format)
Optional removal of source files after successful processing
Culture-aware date parsing and formatting for international DNS servers
Optimized for large files (100MB + ) using streaming I/O and efficient string operations
Compatible with PowerShell 5.1+ (Desktop and Core editions)
Supports Windows Server 2016+ and DNS Server 2012 R2 through 2025 log formats

Release notes v1.1.0 (2026-01-23)

Fri, 23 Jan 2026 00:00:00 +0000

Added

NEW: ContextFilter parameter for selective log parsing
- Filter log entries by context type: PACKET (DNS queries/responses), EVENT (server events), or Note (diagnostic information)
- Allows focused analysis on specific log entry types
- Default: All (includes all context types)
- Use cases: Focus on DNS traffic only, monitor server events, troubleshoot diagnostic issues
NEW: Information field in CSV output
- Captures detailed information for EVENT and Note context entries
- Examples: “The DNS server has started.”, “Zone loading completed”, socket errors, internal state messages
- Enhances visibility into DNS server operational events and diagnostics
- Field is populated when Context is EVENT or Note; empty for PACKET entries

Changed

BREAKING: ComputerName column now always included at the end of all output records
- Previously: ComputerName was conditionally included at the beginning when parameter was specified
- Now: ComputerName always present as the last column; empty when parameter not specified
- Benefit: Consistent output structure simplifies multi-server log consolidation and automated processing
- Impact: Existing scripts that parse column positions or expect conditional column presence must be updated

Added

Context filtering to focus on specific log entry types (PACKET, EVENT, NOTE) via ContextFilter parameter

Improved

Refactored comment-based help for Convert-DNSDebugLogFile for better clarity and conciseness
Updated parameter descriptions to be more informative and actionable
Improved example documentation with more focused and practical use cases
Enhanced about_DNSServer.DebugLogParser help file to reflect current functionality
Enhanced verbose logging to provide more detailed progress information during processing

Legal Notice

Sun, 18 Jan 2026 00:00:00 +0000

Information pursuant to Section 5 of the German Telemedia Act (TMG)

Legal notice

Andreas Bellstedt
Brunnenstr. 38
75387 Neubulach
Germany

Contact

Email: blog@andibellstedt.com

Legal form / business status

This website is operated by a private individual / sole proprietor.

Responsible for content pursuant to Section 55(2) of the German Interstate Broadcasting Treaty (RStV)

Andreas Bellstedt
(Address above)

Liability for content

As a service provider, we are responsible for our own content on these pages in accordance with Section 7(1) TMG under general law. Pursuant to Sections 8–10 TMG, however, we are not obligated to monitor transmitted or stored third‑party information or to investigate circumstances that indicate illegal activity.

Privacy Policy

Sun, 18 Jan 2026 00:00:00 +0000

Privacy Policy

1. Privacy at a Glance

General Notes

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data are all data with which you can be personally identified. Detailed information on the topic of data protection can be found in our privacy policy listed below this text.

Data Collection on this Website

Who is responsible for data collection on this website?

The data processing on this website is carried out by the website operator. Their contact details can be found in the section “Notice on the Data Controller” in this privacy policy.

About the Author

Mon, 01 Jan 0001 00:00:00 +0000

Hello to the World!

I’m Andreas Bellstedt — an IT professional with more than 20 years of experience across enterprise environments. Usually I am called Andi.
I’m passionate about technology, but even more about applying it in a way that improves reliability, security, and operational efficiency.

Practical usage in a Domain Environment (GPO-driven collection and conversion)

Mon, 01 Jan 0001 00:00:00 +0000

This document outlines a practical, end-to-end example of running DNSServer.DebugLogParser in an Active Directory domain environment, focused on converting Windows DNS Server debug logs on domain controllers.

This example is accompanied by a ZIP archive, which provide the policy artifacts used to implement the workflow described here.
The most relevant artifacts are backup manifest, GPO report, Files.xml, Set-DNSServerDebugLogging.ps1, and ScheduledTasks.xml.

Scenario

Multiple domain controllers (DCs) host the DNS Server role.
DNS debug logging is enabled and configured consistently on each DC via a scheduled task (writing log files to C:\Administration\Logs\DNSServer).
A centrally managed process converts logs into CSV for:
- security analytics
- operational reporting
- troubleshooting
- compliance/retention

Target outcomes

Consistent conversion settings across all DCs
Predictable output location and naming
Optional compression to reduce storage footprint
Optional statistics outputs for quick daily rollups
Minimal host-side risk, with explicit rerun and cleanup considerations

Suggested architecture

Collection model: local convert + central pull

Each DC writes DNS debug logs to disk with rollover enabled.
Each DC converts rotated *.log files into a data CSV and statistics CSVs, then compresses the outputs into *.zip on a schedule (Task Scheduler).
Outputs are written next to the log files so the pipeline stays simple.
A central server collects the *.zip outputs, for example via file share ingestion, scheduled copy, SIEM forwarder, or an agent-based collector.

This model minimizes network reads of large raw log files and keeps parsing close to the data.

Scheduled Task Example

Mon, 01 Jan 0001 00:00:00 +0000

This script creates a Windows Scheduled Task that runs daily at 2:00 AM. It imports the module and processes all the log file in the folder where the script is executed (in this example “C:\Administration\Logs\DNS”). The process does compress the output into ZIP-files and removes the original to maintain hygiene.

$actionParams = @{
 Execute = "powershell.exe"
 Argument = '-ExecutionPolicy RemoteSigned -Command "Import-Module DNSServer.DebugLogParser; Get-ChildItem .\*.log | Sort-Object lastwritetime, Name -Descending | Convert-DNSDebugLogFile -ComputerName $env:COMPUTERNAME -Delimiter \";\" -OutputType Both -ContextFilter Packet -OutputCulture sv-SE -CompressOutput"'
 WorkingDirectory = "C:\Administration\Logs\DNS"
}
$Action = New-ScheduledTaskAction @actionParams

$Trigger = New-ScheduledTaskTrigger -Daily -At "2:00AM"

Register-ScheduledTask -TaskName "Process DNS Logs" -Action $Action -Trigger $Trigger -Description "Convert DNS debug logs to CSV daily"

Search Results

Mon, 01 Jan 0001 00:00:00 +0000

Website information

Mon, 01 Jan 0001 00:00:00 +0000

Build information

Site built with [Docsy] theme for Hugo.

Security Analysis Workflow with SQL Server

Mon, 01 Jan 0001 00:00:00 +0000

This example shows a practical workflow for security analytics: parse a DNS debug log with Convert-DNSDebugLogFile, import the generated CSV into SQL Server, and run a query that highlights unusually high volumes of TXT record lookups.

For best interoperability, this example writes timestamps in an ISO-like format by using -OutputCulture 'sv-SE'.

Required modules

This example uses the following PowerShell modules:

DNSServer.DebugLogParser
SqlServer

Install them if needed:

Install-Module -Name DNSServer.DebugLogParser -Scope CurrentUser
Install-Module -Name SqlServer -Scope CurrentUser

Scenario

Use this workflow when you want to move parsed DNS debug log data into SQL Server so you can: