Page Comparison

The dns.windows tag identifies log events generated by the Windows Server Domain Name System (DNS).

...

This technology uses a single tag to support all events generated by the Windows Server Domain Name System (DNS). The tag is simply dns.windows and the associated events are saved in Devo in a table of the same name.

For more information, read more about Devo tags.

...

Create a simple rule on your Devo Relay that applies the dns.windows tag to all events arriving on a specified port. In the example below, we use port 13003 but you should use any port that you can dedicate to these events.

• Source

  Port → 13003

  port → 13003

• Target

  Tag →

  tag → dns.windows

• Check the Stop processing and Sent without syslog tag checkboxes.

Table structure

These are the fields displayed in this table:

dns.

...

windows

ifthenelse(isnotnull(dnsserverfilebeat), dnsserverfilebeat, vhost)

parsedate(myserverdate, "MM/DD/YYYY hh:mm:ss A", "UTC")

trim(mycontext)

trim(myintpacketid)

trim(myprotocol)

trim(mysendreceive)

trim(myxid)

(myqueryresponse -> '  ') ? ' ' : 'R'

(myqueryresponse -> '  ') ? 'query' : 'response'

trim(myopcode)

trim(myflagshex)

trim(myflagscharcodes)

trim(myresponsecode)

trim(myquestiontype)

join(question_tokens, ".")

Related articles

• About Devo tags