Share via

Are TYPE, CLASS, TTL, DLEN, DATA fields absent in the Answer Section in DNS debug logs in Windows Server 2022?

Siddharth Fultariya 5 Reputation points
2023-03-07T05:13:16.94+00:00
I am working on analyzing the different types of debug logs produced in Windows. So we are collecting logs from all the different types of servers, and we found that the logs from 2012, 2016, and 2019 servers contain the following format for the Answer Section of the Log in the detailed view:

ANSWER SECTION:
    Offset = 0x0025, RR count = 0

    Name      "[C00C](4)bdcm(3)scd(6)spsdck(3)com(0)"

      TYPE   A  (1)

      CLASS  1

      TTL    44

      DLEN   4

      DATA   10.152.82.20

    Offset = 0x0035, RR count = 1

    Name      "[C00C](4)bdcm(3)scd(6)spsdck(3)com(0)"

      TYPE   A  (1)

      CLASS  1

      TTL    44

      DLEN   4

      DATA   12.17.84.62

However, the logs from the Windows 2022 server follow the following format, notice the difference absence of TYPE, CLASS, TTL, DLEN, and DATA fields in the answer section:

ANSWER SECTION:  
    Offset = 0x001e, RR count = 0

    Name = [C00C](4)bdcm(3)scd(6)spsdck(3)com(0)

    Offset = 0x004f, RR count = 1

    Name = [C02A](4)bdcm(3)scd(6)spsdck(3)com(0)

Can someone help me understand this behavior? Is there a change in the Log Format for Windows Server 2022 or is there a parameter to be set separately in the 2022 Server to get these fields? 

Thanks!
Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Windows for business | Windows Server | User experience | Other
0 comments No comments
{count} vote

3 answers

Sort by: Most helpful
  1. Stefan Vater 0 Reputation points
    2025-09-29T07:57:59.64+00:00

    I can also reproduce this issue. Any Updates?

    0 comments No comments

  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.