# Output Formats

LLMS index: [llms.txt](/v1.2.0.0/llms.txt)

---

DNSServer.DebugLogParser can generate two types of output:

- A CSV data file containing all parsed entries
- Optional statistics files for daily aggregation

To see real-world examples of each output type, check the sample in this article.

## CSV data file

Example output files:

- en-US (no details): [WithComputerName](../outputformat/en-us.-.dnsdebug-dc01.-.WithComputerName.csv), [NoComputerName](../outputformat/en-us.-.dnsdebug-dc01.-.NoComputerName.csv)
- de-DE (no details): [WithComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.WithComputerName.-.NoDetails.csv), [NoComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.NoComputerName.-.NoDetails.csv)
- de-DE (with details / `Details` JSON populated for Packet detail blocks): [WithComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.WithComputerName.-.WithDetails.csv), [NoComputerName](../outputformat/de-de.-.dnsdebug-dc01.-.NoComputerName.-.WithDetails.csv)

The CSV data file contains all parsed log entries with the following columns:

- `DateTime`: Date and time of the DNS query/response
- `ThreadId`: Internal DNS server thread identifier
- `Context`: Operation context (for example Packet, Event, Note, DSPoll, Init, Lookup, Recurse, Remote, Tombstone)
- `PacketId`: DNS packet identifier
- `Protocol`: UDP or TCP
- `Direction`: `Rcv` (received/query) or `Snd` (sent/response)
- `ClientIP`: Client IP address
- `Xid`: Transaction ID (hex)
- `Type`: Query or Response
- `Opcode`: Standard, Notify, Update, or Unknown
- `FlagsHex`: Query/response flags (hex)
- `FlagsChar`: Flags decoded (Authoritative, Truncated, RecursionDesired, RecursionAvailable)
- `ResponseCode`: NOERROR, NXDOMAIN, SERVFAIL, etc.
- `QuestionType`: DNS record type (A, AAAA, MX, PTR, etc.)
- `QuestionName`: Domain name queried
- `Information`: Additional information (for Event/Note/etc.; for Packet detail blocks, contains the TCP/UDP detail header line)
- `Details`: JSON data for Packet entries that include detail blocks (empty otherwise)
- `ComputerName`: Source server name (always present; empty if not specified)

Note: The `ComputerName` column is always included at the end of each record to ensure consistent output structure. This facilitates multi-server log consolidation scenarios.

## Statistics files (optional)

Example output files:

- Context statistics: [en-US (WithComputerName)](../outputformat/en-us.-.dnsdebug-dc01_Statistic.-.WithComputerName.csv), [en-US (NoComputerName)](../outputformat/en-us.-.dnsdebug-dc01_Statistic.-.NoComputerName.csv), [de-DE (WithComputerName)](../outputformat/de-de.-.dnsdebug-dc01_Statistic.-.WithComputerName.csv), [de-DE (NoComputerName)](../outputformat/de-de.-.dnsdebug-dc01_Statistic.-.NoComputerName.csv)
- Packet statistics: [en-US (WithComputerName)](../outputformat/en-us.-.dnsdebug-dc01_PacketStatistic.-.WithComputerName.csv), [en-US (NoComputerName)](../outputformat/en-us.-.dnsdebug-dc01_PacketStatistic.-.NoComputerName.csv), [de-DE (WithComputerName)](../outputformat/de-de.-.dnsdebug-dc01_PacketStatistic.-.WithComputerName.csv), [de-DE (NoComputerName)](../outputformat/de-de.-.dnsdebug-dc01_PacketStatistic.-.NoComputerName.csv)

When statistics are generated, two separate files are created:

### 1) Context statistics (`*_Statistic.csv`)

Columns:

- `Date`: Date (`yyyy-MM-dd`)
- `Context`: Context name (for example Packet, Event, Note)
- `Count`: Number of records
- `ComputerName`: Source server name

### 2) Packet statistics (`*_PacketStatistic.csv`)

Columns:

- `Date`: Date (`yyyy-MM-dd`)
- `ClientIP`: Client IP address
- `Protocol`: UDP or TCP
- `Direction`: `Rcv` or `Snd`
- `QuestionType`: DNS record type
- `Count`: Number of records
- `ComputerName`: Source server name