Skip to main content

Responses are generated using AI and may contain mistakes.

Site CollectorSite Collector Administration Guide

Collect DNS Multiline Debug Logs

This section describes how to use the Windows File Collector to ingest Windows DNS Debug Logs. Since DNS events span multiple lines, multiline processing must be enabled to capture each event as a single, complete record. Using single-line mode splits events into separate lines, resulting in incomplete and inaccurate data.

Each event begins with a timestamp in the format M/D/YYYY H:MM:SS AM/PM, followed by continuation lines such as socket and message details that do not include timestamps. A new timestamp marks the start of the next event and the end of the previous one. Additionally, the log file uses UTF-16LE encoding which is Windows DNS Server default, where each character is stored as 2 bytes with a 0x00 high byte.

Use the following steps to create a Multiline Template.

  1. Log in to the New-Scale Security Operations Platform with your registered credentials.

  2. Navigate to Collectors > Site Collectors.

  3. On the Site Collector page, click the Templates Manager tab, then click New Template.

    DNS_1.png

  4. Click Windows File.

    DNS_2.png

  5. Specify a name for the new template.

  6. In the New Windows File Template window, select the processing mode as MULTI-LINE.

    DNS_3.png

    Only one multiline template is allowed per log source path.

  7. Set the parsing rules by adding regex pattern. The parsing rules define where each DNS event starts and ends. Specify regex pattern in the Parsing Rules section for the following fields.

    • Head – Enter the regex pattern for example, ^\d{1,2}/\d{1,2}/\d{4}\s+\d{1,2}:\d{2}:\d{2}\s+(AM|PM).

      Note

      The Start Pattern is always required because it identifies the first line of a new event.

    • Tail – Leave empty for DNS logs. The End Pattern is optional.

  8. Click Check Patterns to validate your regex against sample lines.

  9. Specify regex pattern in the Parsing Rules section for the following fields.

    • Include – Enter exactly one regex path that identifies the log file(s) to collect. For Example, C:\Windows\System32\dns\dns.log.

    • Exclude – This is optional. Click + File path button to add one or more regex patterns for files that should be ignored even if they match the include pattern. Multiple exclude entries are supported. Refer to the following examples. To collect everything matched by the include path, leave empty.

  10. Click Create.

    The template is created. Use this template while configuring the Windows File Collector. Based on this template, the Windows File collector begins aggregating DNS log lines into complete events.