About this documentation

• 1: Overview
• 2: Operational Best Practices
• 3: Troubleshooting
• 4: Module commands reference
• 4.1: Convert-DNSDebugLogFile

1 - Overview

DNSServer.DebugLogParser is a PowerShell module that transforms Windows DNS Server debug log files into structured, analyzable CSV data for security analysis, performance monitoring, troubleshooting, and compliance reporting.

What is a DNS debug log?

DNS debug logging is a feature of Windows DNS Server that records detailed information about DNS operations. When enabled, the DNS Server writes log entries to a text file (typically dns.log) in the DNS Server’s directory.

Each log entry contains up to 16 fields including:

• Date and time of the query
• Protocol used (UDP or TCP)
• Direction (Send or Receive)
• Client IP address
• Query type (A, AAAA, MX, PTR, etc.)
• Domain name queried
• Response code (NOERROR, NXDOMAIN, etc.)
• Query flags and options
• IP address in response (for successful queries)
• Port numbers and additional technical details

Why parse DNS debug logs?

DNS logs are critical for:

Troubleshooting

• Diagnose name resolution failures
• Identify misconfigured clients or applications
• Track down the source of problematic queries
• Verify proper DNS configuration and zone transfers

Performance monitoring

• Identify high-volume query sources
• Analyze query types and patterns to optimize DNS infrastructure
• Detect configuration issues causing excessive queries
• Track response times and success rates
• Monitor DNS server load and capacity

Security analysis

• Detect DNS tunneling and data exfiltration attempts
• Identify domains associated with malware and command-and-control servers
• Track suspicious query patterns that may indicate compromised systems
• Monitor for DNS amplification attacks
• Investigate security incidents and trace attacker activity

Compliance and auditing

• Meet regulatory requirements for logging and retention
• Document network activity for audit trails
• Generate reports for management and compliance officers
• Demonstrate due diligence in security monitoring

How the module works (high level)

The module is optimized for large files and processes DNS debug logs into structured CSV output. It supports multi-line records (for example PACKET detail blocks and indented continuation lines) so that event/diagnostic messages and packet details stay attached to the correct record.

Key capabilities:

• Parses the native DNS debug log fields and produces a consistent CSV layout
• Handles multiple DNS Server versions (2012 R2 through 2025)
• Supports both PowerShell Desktop (5.1+) and Core (7.x)
• Processes files of any size (tested with 100MB+ files)
• Validates log file headers to ensure data integrity
• Generates optional statistical summaries
• Supports batch processing via PowerShell pipeline
• Optionally compresses output files to save disk space
• Can automatically remove source files after successful processing
• Culture-aware date parsing for international DNS server logs
• Culture-aware date formatting for international output requirements

Licensing and support

The module is released under the MIT License. Community support is available through GitHub Issues.

• GitHub repository: https://github.com/AndiBellstedt/DNSServer.DebugLogParser
• PowerShell Gallery: https://www.powershellgallery.com/packages/DNSServer.DebugLogParser

2 - Operational Best Practices

When using DNSServer.DebugLogParser in production:

1. Schedule regular processing

   • Use Task Scheduler to automatically convert new log files daily or weekly.

2. Rotate logs appropriately

   • DNS debug logs can grow quickly; configure rotation at a manageable size (for example 100MB).

3. Validate output

   • Verify the first few converted files before fully automating.

4. Plan storage requirements

   • Even with compression, plan storage based on DNS volume and retention.

5. Secure sensitive data

   • DNS logs can be sensitive; protect outputs with appropriate access controls.

6. Document your workflow

   • Document processing schedules, storage locations, and analysis usage.

7. Test with sample files

   • Validate parameters and output format before processing critical logs.

8. Monitor for errors

   • Watch for corrupted logs, access issues, or insufficient disk space.

3 - Troubleshooting

Common issues and solutions

“The file is not a valid DNS debug log file”

• Ensure you’re converting an actual DNS Server debug log.
• The file should start with Message logging started at or contain DNS query entries.
• If you’re certain the file is valid but the header differs, use -SkipHeaderValidation.

Output file is empty or incomplete

• Confirm the input file contains valid log entries.
• Some logs may only contain header information if no queries occurred.
• Verify the log file isn’t corrupted and contains actual query data.

Processing is very slow

• Ensure sufficient memory and that the disk is not heavily loaded.
• Consider processing smaller log files.
• Consider -CompressOutput with scheduled processing to handle smaller batches.

“Access denied” errors

• Run PowerShell with appropriate permissions to read the source log files and write to the destination directory.
• DNS log files may require administrator access.

Compressed output is larger than expected

• Logs with many unique values compress less efficiently; this can be normal.
• ZIP compression still typically achieves substantial reduction.

Statistics file doesn’t match expectations

• Verify you’re using -OutputType Both or -OutputType Statistic.
• Statistics are aggregated counts (daily groupings), so values represent totals.

Reporting issues

If you encounter problems not covered here:

1. Verify you’re using the latest version of the module.
2. Check GitHub Issues for similar problems.
3. Collect diagnostic information:
   • PowerShell version ($PSVersionTable)
   • Module version (Get-Module DNSServer.DebugLogParser)
   • Sample log file (if possible)
   • Full error message and stack trace
4. Open a new GitHub issue with details.

4 - Module commands reference

By clicking on a command, you will be taken to a detailed page that provides comprehensive information about the command, including its syntax, parameters, examples, and any additional notes or tips for usage.

4.1 - Convert-DNSDebugLogFile

SYNOPSIS

Transforms Windows DNS Server debug logs into structured CSV format for analysis and reporting.

SYNTAX

__AllParameterSets

Convert-DNSDebugLogFile [-InputFile] <string[]> [[-OutputFile] <string>] [[-Delimiter] <string>]
 [[-ComputerName] <string>] [[-OutputType] <string>] [[-ContextFilter] <string>]
 [[-InputCulture] <cultureinfo>] [[-OutputCulture] <cultureinfo>] [-SkipHeaderValidation]
 [-RemoveSourceFile] [-CompressOutput] [-WhatIf] [-Confirm] [<CommonParameters>]

ALIASES

This cmdlet has the following aliases,

DESCRIPTION

Converts Windows DNS Server debug log files into structured CSV data that can be analyzed in Excel, Power BI, SQL databases, or SIEM tools. Designed for security analysis, performance monitoring, troubleshooting, and compliance reporting.

The cmdlet parses all 17 fields from DNS debug logs including date/time, protocol, client IP, query type, domain names, response codes, flags, event information, and computer name. It generates structured CSV output with an optional statistics summary aggregating activity by client, protocol, and query type.

KEY FEATURES:

• High-performance parsing optimized for large files (100MB+)
• Customizable CSV delimiter (default: semicolon)
• Optional statistical summaries with aggregated metrics
• Context filtering (PACKET, EVENT, Note) to focus on specific log entry types
• Culture-aware date parsing and formatting for international servers
• Pipeline support for batch processing multiple files
• Optional compression of output files (ZIP format)
• Optional automatic removal of source files after processing
• Header validation to ensure data integrity

OUTPUT FORMAT: The ComputerName column is always included at the end of each record. If the -ComputerName parameter is not specified, the column will be empty. This ensures consistent output structure for multi-server consolidation scenarios.

PERFORMANCE: Optimized using StreamReader/StreamWriter with 64KB buffers, string operations instead of regex, manual CSV generation, and efficient hashtable-based statistics collection.

COMPATIBILITY:

• PowerShell 5.1+ (Desktop and Core editions)
• Windows Server 2016+
• DNS Server 2012 R2 through 2025 log formats

EXAMPLES

EXAMPLE 1

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log"

Converts the DNS debug log using default settings (both data and statistics files with semicolon delimiter). Output: C:\Logs\dns.csv and C:\Logs\dns_statistic.csv

EXAMPLE 2

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputType CSV

Generates only the data file without statistics. Output: C:\Logs\dns.csv

EXAMPLE 3

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputType Statistic

Generates only the statistics file with aggregated metrics. Output: C:\Logs\dns_statistic.csv

EXAMPLE 4

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -OutputFile "C:\Output\parsed.csv"

Converts the log to a custom output location. Output: C:\Output\parsed.csv

EXAMPLE 5

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -Delimiter "," -ComputerName "DNS01" -OutputType Both

Converts with comma delimiter and adds ComputerName column with value “DNS01”. Output: C:\Logs\dns.csv and C:\Logs\dns_statistic.csv with ComputerName column

EXAMPLE 6

PS C:\> Get-ChildItem "C:\Logs\*.log" | Convert-DNSDebugLogFile -OutputType Both

Batch processes multiple DNS debug log files via pipeline. Output: For each .log file, generates .csv and _statistic.csv files

EXAMPLE 7

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -CompressOutput

Converts and compresses output to ZIP archive. Output: C:\Logs\dns.zip (containing dns.csv and dns_statistic.csv)

EXAMPLE 8

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -RemoveSourceFile -Verbose

Converts the log and removes the source file after successful processing. Verbose output confirms file removal.

EXAMPLE 9

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -InputCulture 'de-DE' -OutputCulture 'en-US'

Parses German date format (DD.MM.YYYY) and outputs in US format (MM/DD/YYYY). Use when processing logs from servers with different regional settings.

EXAMPLE 10

PS C:\> Convert-DNSDebugLogFile -InputFile "C:\Logs\dns.log" -ContextFilter 'Packet'

Converts only DNS query/response packet entries, excluding EVENT and Note entries. Use to focus analysis on actual DNS traffic.

EXAMPLE 11

PS C:\> Get-ChildItem "C:\Logs\*.log" | Convert-DNSDebugLogFile -RemoveSourceFile -CompressOutput

Automated log archival: processes all logs, compresses output, and removes source files. Ideal for scheduled log processing pipelines.

PARAMETERS

-CompressOutput

Compresses output CSV files into a ZIP archive after creation.

Creates a .zip file containing the generated CSV file(s), then removes the uncompressed CSV(s). The ZIP file is created in the same directory as the output CSV with the same base name.

Benefits:

• Significantly reduces disk space (CSV files typically compress 90%+)
• Simplifies file management and archival
• Suitable for long-term storage

Example: Input ‘dns.log’ generates ‘dns.csv’ compressed to ‘dns.zip’, then ‘dns.csv’ is removed.

Type: SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ComputerName

Specifies the value for the ComputerName column in the CSV output. The ComputerName column is always present in the output - if this parameter is not specified, the column will be empty.

Use this when consolidating logs from multiple DNS servers to identify the source server in combined datasets.

Note: This is NOT a remoting parameter. The cmdlet processes local files only.

Type: String
DefaultValue: ''
SupportsWildcards: false
Aliases:
- Server
- DNSServer
- HostName
ParameterSets:
- Name: (All)
  Position: 3
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Confirm

Prompts you for confirmation before running the cmdlet.

When specified, prompts for confirmation before:

• Processing each DNS debug log file
• Removing source files (when -RemoveSourceFile is specified)
• Overwriting existing output files

Useful for interactive processing when you want to control which files are processed.

Type: SwitchParameter
DefaultValue: ''
SupportsWildcards: false
Aliases:
- cf
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ContextFilter

Filters which log entry types to include in the output.

DNS debug logs contain different context types:

• PACKET: DNS query and response packet information (primary data)
• EVENT: DNS server events (e.g., “The DNS server has started.”)
• Note: Diagnostic notes and warnings (e.g., socket errors, internal states)

Valid values:

• ‘All’: Include all context types (default)
• ‘Packet’: Include only PACKET entries (DNS queries/responses)
• ‘Event’: Include only EVENT entries (server events)
• ‘Note’: Include only Note entries (diagnostic information)

Default: All

Note: When filtering to ‘Event’ or ‘Note’, only DateTime, ThreadId, Context, and Information columns will contain data. Other columns (Protocol, ClientIP, etc.) will be empty.

Type: String
DefaultValue: All
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 5
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-Delimiter

Specifies the delimiter character for the CSV output.

Default: Semicolon (;)

Common alternatives: Comma (,), Tab (`t), Pipe (|)

Use semicolon in regions where comma is the decimal separator (Europe). Use comma for standard CSV tools and databases that expect comma-separated values.

Type: String
DefaultValue: ;
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 2
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-InputCulture

Specifies the culture/locale to use for parsing date/time values in the DNS debug log.

DNS Server debug logs use the date format of the Windows locale on the server where the log was generated. Use this parameter when processing logs from servers with different regional settings.

Default: Current culture

Common examples:

• ‘de-DE’ or ‘de-AT’: German format (DD.MM.YYYY or DD/MM/YYYY)
• ’en-US’: US format (MM/DD/YYYY with AM/PM)
• ’en-GB’: UK format (DD/MM/YYYY with 24-hour time)
• ‘sv-SE’: Swedish/ISO format (YYYY-MM-DD)

Type: CultureInfo
DefaultValue: '[System.Globalization.CultureInfo]::CurrentCulture'
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 6
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-InputFile

Specifies the path to the DNS debug log file to parse. Supports arrays for processing multiple files.

Accepts pipeline input from Get-ChildItem or other file-producing cmdlets.

Type: String[]
DefaultValue: ''
SupportsWildcards: false
Aliases:
- FullName
- FilePath
- InputPath
- File
- Path
ParameterSets:
- Name: (All)
  Position: 0
  IsRequired: true
  ValueFromPipeline: true
  ValueFromPipelineByPropertyName: true
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-OutputCulture

Specifies the culture/locale to use for formatting date/time values in the output CSV files.

Controls how DateTime values are written to the CSV. Use this when CSV files will be consumed by applications or systems with specific regional settings.

Default: Current culture

Common examples:

• ’en-US’: US format (MM/DD/YYYY)
• ‘de-DE’: German format (DD.MM.YYYY)
• ‘sv-SE’ or InvariantCulture: ISO format (YYYY-MM-DD) for maximum compatibility

Type: CultureInfo
DefaultValue: '[System.Globalization.CultureInfo]::CurrentCulture'
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 7
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-OutputFile

Specifies the path for the output CSV file. If not specified, uses the input filename with .csv extension in the same directory as the input file.

Important: Must be a file path, not a directory. If you want to use the input file’s directory with a custom name, specify the full path including filename.

Type: String
DefaultValue: ''
SupportsWildcards: false
Aliases:
- Output
- Destination
- OutFile
- OutputPath
ParameterSets:
- Name: (All)
  Position: 1
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-OutputType

Specifies the type of output to generate.

Valid values:

• ‘CSV’: Generate only the data file with all parsed log entries (default)
• ‘Statistic’: Generate only the statistics file with aggregated metrics
• ‘Both’: Generate both data and statistics files

Default: Both

Statistics provide aggregated counts by client IP, protocol, direction, and query type, along with date range for each unique combination.

Type: String
DefaultValue: Both
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: 4
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-RemoveSourceFile

Removes the source DNS debug log file after successful processing.

Use this for automated log processing pipelines or disk space management. The source file is only removed if processing completes successfully and all output files are created.

Safety: Cannot be used with -SkipHeaderValidation to prevent accidental deletion of invalid files.

Warning: Source files are permanently deleted. Ensure output files are valid before using this option.

Type: SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-SkipHeaderValidation

Bypasses the DNS debug log header validation check.

By default, the cmdlet validates that input files have a valid DNS Server debug log header. Use this switch to process files without validation, which can be useful for:

• Modified or custom log formats
• Troubleshooting validation issues
• Non-standard or pre-processed logs

Warning: May result in processing errors if the file is not a valid DNS log.

Type: SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

When specified, displays detailed information about the operations that would be performed without actually executing them. Useful for:

• Previewing which files would be processed
• Verifying output file paths before processing
• Testing scripts before running in production

Type: SwitchParameter
DefaultValue: ''
SupportsWildcards: false
Aliases:
- wi
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

System.String[]

NOTES

Version : 1.3.0.1 Author : Andi Bellstedt, Copilot Date : 2026-01-23 Keywords : Microsoft Windows Server, DNSServer, DNS, DebugLog, LogParser

RELATED LINKS

• github.com/AndiBellstedt/DNSServer.DebugLogParser