Microsoft-Windows-DNSServer
167 events across 2 channels
Event ID 256 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
Event ID 256 — QUERY_RECEIVED: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
Event ID 257 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
DNSSEC | — |
RCODE | — |
Port | — |
Flags | — |
Scope | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
StaleRecordsPresent | — |
Event ID 257 — RESPONSE_SUCCESS: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
DNSSEC | — |
RCODE | — |
Port | — |
Flags | — |
Scope | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
StaleRecordsPresent | — |
Event ID 258 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Reason | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
Flags | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
Event ID 258 — RESPONSE_FAILURE: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Reason | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
Flags | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
Event ID 259 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
Reason | — |
QNAME | — |
QTYPE | — |
XID | — |
Zone | — |
PolicyName | — |
AdditionalInfo | — |
Event ID 259 — IGNORED_QUERY: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
Reason | — |
QNAME | — |
QTYPE | — |
XID | — |
Zone | — |
PolicyName | — |
AdditionalInfo | — |
Event ID 260 —
Fields
| Name | Description |
|---|---|
TCP | — |
Destination | — |
InterfaceIP | — |
RD | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
Event ID 260 — RECURSE_QUERY_OUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Destination | — |
InterfaceIP | — |
RD | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
Event ID 261 —
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
RecursionDepth | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
QueriesAttached | — |
Event ID 261 — RECURSE_RESPONSE_IN: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
RecursionDepth | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
QueriesAttached | — |
Event ID 262 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
AdditionalInfo | — |
GUID | — |
Event ID 262 — RECURSE_QUERY_TIMEOUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
AdditionalInfo | — |
GUID | — |
Event ID 263 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
Port | — |
Flags | — |
Secure | — |
BufferSize | — |
PacketData | — |
Event ID 263 — DYN_UPDATE_RECV: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
Port | — |
Flags | — |
Secure | — |
BufferSize | — |
PacketData | — |
Event ID 264 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
Event ID 264 — DYN_UPDATE_RESPONSE: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
Event ID 265 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 265 — IXFR_REQ_OUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 266 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 266 — IXFR_REQ_RECV: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 267 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 267 — IXFR_RESP_OUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 268 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 268 — IXFR_RESP_RECV: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 269 —
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 269 — AXFR_REQ_OUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 270 —
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 270 — AXFR_REQ_RECV: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 271 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
Event ID 271 — AXFR_RESP_OUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
Event ID 272 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
Event ID 272 — AXFR_RESP_RECV: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
Event ID 273 —
Fields
| Name | Description |
|---|---|
Source | — |
InterfaceIP | — |
QNAME | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 273 — XFR_NOTIFY_RECV: Source=.
Message
Fields
| Name | Description |
|---|---|
Source | — |
InterfaceIP | — |
QNAME | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 274 —
Fields
| Name | Description |
|---|---|
Source | — |
InterfaceIP | — |
QNAME | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 274 — XFR_NOTIFY_OUT: Destination=.
Message
Fields
| Name | Description |
|---|---|
Source | — |
InterfaceIP | — |
QNAME | — |
ZoneScope | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 275 —
Fields
| Name | Description |
|---|---|
Source | — |
InterfaceIP | — |
BufferSize | — |
PacketData | — |
Event ID 275 — XFR_NOTIFY_ACK_IN: Source=.
Message
Fields
| Name | Description |
|---|---|
Source | — |
InterfaceIP | — |
BufferSize | — |
PacketData | — |
Event ID 276 —
Fields
| Name | Description |
|---|---|
Destination | — |
InterfaceIP | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 276 — XFR_NOTIFY_ACK_OUT: Destination=.
Message
Fields
| Name | Description |
|---|---|
Destination | — |
InterfaceIP | — |
Zone | — |
BufferSize | — |
PacketData | — |
Event ID 277 —
Fields
| Name | Description |
|---|---|
TCP | — |
ForwardInterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 277 — DYN_UPDATE_FORWARD: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
ForwardInterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 278 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 278 — DYN_UPDATE_RESPONSE_IN: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
BufferSize | — |
PacketData | — |
Event ID 279 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
Port | — |
Flags | — |
XID | — |
BufferSize | — |
PacketData | — |
GUID | — |
Event ID 279 — INTERNAL_LOOKUP_CNAME: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
Port | — |
Flags | — |
XID | — |
BufferSize | — |
PacketData | — |
GUID | — |
Event ID 280 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
Port | — |
Flags | — |
XID | — |
BufferSize | — |
PacketData | — |
GUID | — |
Event ID 280 — INTERNAL_LOOKUP_ADDITIONAL: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
Port | — |
Flags | — |
XID | — |
BufferSize | — |
PacketData | — |
GUID | — |
Event ID 281 —
Fields
| Name | Description |
|---|---|
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
BufferSize | — |
PacketData | — |
Event ID 281 — RRL_TO_BE_DROPPED_RESPONSE: InterfaceIP=.
Message
Fields
| Name | Description |
|---|---|
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
BufferSize | — |
PacketData | — |
Event ID 282 —
Fields
| Name | Description |
|---|---|
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
BufferSize | — |
PacketData | — |
Event ID 282 — RRL_TO_BE_TRUNCATED_RESPONSE: InterfaceIP=.
Message
Fields
| Name | Description |
|---|---|
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
BufferSize | — |
PacketData | — |
Event ID 283 —
Fields
| Name | Description |
|---|---|
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
BufferSize | — |
PacketData | — |
Event ID 283 — RRL_TO_BE_LEAKED_RESPONSE: InterfaceIP=.
Message
Fields
| Name | Description |
|---|---|
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
BufferSize | — |
PacketData | — |
Event ID 284 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
DNSSEC | — |
RCODE | — |
Port | — |
Flags | — |
Scope | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
DataTag | — |
ElapsedTime | — |
GUID | — |
EDNSCorrelationTag | — |
EDNSScopeName | — |
StaleRecordsPresent | — |
Event ID 284 — RESPONSE_SUCCESS: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
DNSSEC | — |
RCODE | — |
Port | — |
Flags | — |
Scope | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
DataTag | — |
ElapsedTime | — |
GUID | — |
EDNSCorrelationTag | — |
EDNSScopeName | — |
StaleRecordsPresent | — |
Event ID 285 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Reason | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
Flags | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
EDNSCorrelationTag | — |
EDNSScopeName | — |
Event ID 285 — RESPONSE_FAILURE: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Reason | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
Flags | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
EDNSCorrelationTag | — |
EDNSScopeName | — |
Event ID 286 —
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
ServerScope | — |
CacheScope | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
AliasFailureReason | — |
Event ID 286 — RECURSE_ALIAS_FAILURE: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
ServerScope | — |
CacheScope | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
AliasFailureReason | — |
Event ID 287 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
BufferSize | — |
PacketData | — |
GUID | — |
EDNSExtendedRCodeBits | — |
EDNSFlags | — |
EDNSUdpPayloadSize | — |
EDNSScopeName | — |
EDNSVirtualizationInstance | — |
EDNSDataTag | — |
EDNSCorrelationTag | — |
Event ID 287 — QUERY_RECEIVED: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
BufferSize | — |
PacketData | — |
GUID | — |
EDNSExtendedRCodeBits | — |
EDNSFlags | — |
EDNSUdpPayloadSize | — |
EDNSScopeName | — |
EDNSVirtualizationInstance | — |
EDNSDataTag | — |
EDNSCorrelationTag | — |
Event ID 288 —
Fields
| Name | Description |
|---|---|
QNAME | — |
RRTYPE | — |
QueryGUID | — |
QXID | — |
XID | — |
CacheNodeName | — |
Event ID 288 — DNSSEC_VALIDATION_FAILURE: QNAME=.
Message
Fields
| Name | Description |
|---|---|
QNAME | — |
RRTYPE | — |
QueryGUID | — |
QXID | — |
XID | — |
CacheNodeName | — |
Event ID 289 —
Fields
| Name | Description |
|---|---|
TCP | — |
Destination | — |
InterfaceIP | — |
RD | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
EDNSScopeName | — |
EDNSCorrelationTag | — |
Event ID 289 — RECURSE_QUERY_OUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Destination | — |
InterfaceIP | — |
RD | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
EDNSScopeName | — |
EDNSCorrelationTag | — |
Event ID 290 —
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
RecursionDepth | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
QueriesAttached | — |
EDNSScopeName | — |
EDNSCorrelationTag | — |
Event ID 290 — RECURSE_RESPONSE_IN: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
Source | — |
InterfaceIP | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
RecursionDepth | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
QueriesAttached | — |
EDNSScopeName | — |
EDNSCorrelationTag | — |
Event ID 291 —
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
AdditionalInfo | — |
GUID | — |
EDNSScopeName | — |
EDNSCorrelationTag | — |
Event ID 291 — RECURSE_QUERY_TIMEOUT: TCP=.
Message
Fields
| Name | Description |
|---|---|
TCP | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
QTYPE | — |
QXID | — |
XID | — |
Port | — |
Flags | — |
RecursionScope | — |
CacheScope | — |
AdditionalInfo | — |
GUID | — |
EDNSScopeName | — |
EDNSCorrelationTag | — |
Event ID 512 —
Message
Fields
| Name | Description |
|---|---|
Name | — |
Type | — |
Lookup | — |
ReplicationScope | — |
ZoneFile | — |
VirtualizationID | — |
Example Event
system:
provider: Microsoft-Windows-DNSServer
guid: EB79061A-A566-4698-9119-3ED2807060E7
event_source_name: ''
event_id: 512
version: 0
level: 4
task: 5
opcode: 0
keywords: 4611686018427912192
time_created: '2022-04-07T08:13:51.370284+00:00'
event_record_id: 4
correlation: {}
execution:
process_id: 2208
thread_id: 4676
channel: Microsoft-Windows-DNSServer/Audit
computer: WIN-FPV0DSIC9O6
security:
user_id: S-1-5-21-2121334350-1110938707-2888912545-500
event_data:
Name: _msdcs.sigma.fr
Type: Primary
Lookup: Forward
ReplicationScope: None
ZoneFile: _msdcs.sigma.fr.dns
VirtualizationID: .
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 513 — The zone %1 was deleted.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
VirtualizationID | — |
Event ID 514 —
Message
Fields
| Name | Description |
|---|---|
Zone | — |
PropertyKey | — |
NewValue | — |
VirtualizationID | — |
Example Event
system:
provider: Microsoft-Windows-DNSServer
guid: EB79061A-A566-4698-9119-3ED2807060E7
event_source_name: ''
event_id: 514
version: 0
level: 4
task: 5
opcode: 0
keywords: 4611686018427912192
time_created: '2022-04-07T17:00:03.792940+00:00'
event_record_id: 39
correlation: {}
execution:
process_id: 2320
thread_id: 764
channel: Microsoft-Windows-DNSServer/Audit
computer: WIN-FPV0DSIC9O6.sigma.fr
security:
user_id: S-1-5-18
event_data:
Zone: _msdcs.sigma.fr
PropertyKey: SecondaryServers
NewValue: deny zone transfers
VirtualizationID: .
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 515 — A resource record of type %1, name %2, TTL %3 and RDATA %5 was created in scope %7 of zone %6.
Message
Fields
| Name | Description |
|---|---|
Type | — |
NAME | — |
TTL | — |
BufferSize | — |
RDATA | — |
Zone | — |
ZoneScope | — |
VirtualizationID | — |
Event ID 516 — A resource record of type %1, name %2 and RDATA %5 was deleted from scope %7 of zone %6.
Message
Fields
| Name | Description |
|---|---|
Type | — |
NAME | — |
TTL | — |
BufferSize | — |
RDATA | — |
Zone | — |
ZoneScope | — |
VirtualizationID | — |
Event ID 517 — All resource records of type %1, name %2 were deleted from scope %4 of zone %3.
Message
Fields
| Name | Description |
|---|---|
Type | — |
NAME | — |
Zone | — |
ZoneScope | — |
VirtualizationID | — |
Event ID 518 — All resource records at Node name %1 were deleted from scope %3 of zone %2.
Message
Fields
| Name | Description |
|---|---|
NAME | — |
Zone | — |
ZoneScope | — |
VirtualizationID | — |
Event ID 519 —
Message
Fields
| Name | Description |
|---|---|
Type | — |
NAME | — |
TTL | — |
BufferSize | — |
RDATA | — |
Zone | — |
ZoneScope | — |
Source | — |
Example Event
system:
provider: Microsoft-Windows-DNSServer
guid: EB79061A-A566-4698-9119-3ED2807060E7
event_source_name: ''
event_id: 519
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018460942336
time_created: '2022-04-07T17:30:00.948256+00:00'
event_record_id: 46
correlation: {}
execution:
process_id: 2320
thread_id: 2992
channel: Microsoft-Windows-DNSServer/Audit
computer: WIN-FPV0DSIC9O6.sigma.fr
security:
user_id: S-1-5-18
event_data:
Type: 1
NAME: win-fpv0dsic9o6
TTL: 1200
BufferSize: 4
RDATA: 0A000285
Zone: sigma.fr
ZoneScope: Default
Source: 10.0.2.133
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 520 —
Message
Fields
| Name | Description |
|---|---|
Type | — |
NAME | — |
TTL | — |
BufferSize | — |
RDATA | — |
Zone | — |
ZoneScope | — |
Source | — |
Example Event
system:
provider: Microsoft-Windows-DNSServer
guid: EB79061A-A566-4698-9119-3ED2807060E7
event_source_name: ''
event_id: 520
version: 0
level: 4
task: 3
opcode: 0
keywords: 4611686018460942336
time_created: '2022-04-07T17:30:00.948254+00:00'
event_record_id: 45
correlation: {}
execution:
process_id: 2320
thread_id: 2992
channel: Microsoft-Windows-DNSServer/Audit
computer: WIN-FPV0DSIC9O6.sigma.fr
security:
user_id: S-1-5-18
event_data:
Type: 1
NAME: win-fpv0dsic9o6
TTL: 0
BufferSize: 4
RDATA: 0A000285
Zone: sigma.fr
ZoneScope: Default
Source: 10.0.2.133
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 521 — A resource record of type %1, name %2, TTL %3 and RDATA %5 was scavenged from scope %7 of zone %6.
Message
Fields
| Name | Description |
|---|---|
Type | — |
NAME | — |
TTL | — |
BufferSize | — |
RDATA | — |
Zone | — |
ZoneScope | — |
VirtualizationID | — |
Event ID 522 — The scope %1 was created in zone %2.
Message
Fields
| Name | Description |
|---|---|
ZoneScope | — |
Zone | — |
VirtualizationID | — |
Event ID 523 — The scope %1 was deleted in zone %2.
Message
Fields
| Name | Description |
|---|---|
ZoneScope | — |
Zone | — |
VirtualizationID | — |
Event ID 525 — The zone %1 was signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgorith...
Message
Fields
| Name | Description |
|---|---|
ZoneName | — |
DenialOfExistence | — |
DistributeTrustAnchor | — |
DnsKeyRecordSetTtl | — |
DSRecordGenerationAlgorithm | — |
DSRecordSetTtl | — |
EnableRfc5011KeyRollover | — |
IsKeyMasterServer | — |
KeyMasterServer | — |
NSec3HashAlgorithm | — |
NSec3Iterations | — |
NSec3OptOut | — |
NSec3RandomSaltLength | — |
NSec3UserSalt | — |
ParentHasSecureDelegation | — |
PropagationTime | — |
SecureDelegationPollingPeriod | — |
SignatureInceptionOffset | — |
Event ID 526 — The zone %1 was unsigned.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
Event ID 527 — The zone %1 was re-signed with following properties: DenialOfExistence=%2; DistributeTrustAnchor=%3; DnsKeyRecordSetTtl=%4; DSRecordGenerationAlgor...
Message
Fields
| Name | Description |
|---|---|
ZoneName | — |
DenialOfExistence | — |
DistributeTrustAnchor | — |
DnsKeyRecordSetTtl | — |
DSRecordGenerationAlgorithm | — |
DSRecordSetTtl | — |
EnableRfc5011KeyRollover | — |
IsKeyMasterServer | — |
KeyMasterServer | — |
NSec3HashAlgorithm | — |
NSec3Iterations | — |
NSec3OptOut | — |
NSec3RandomSaltLength | — |
NSec3UserSalt | — |
ParentHasSecureDelegation | — |
PropagationTime | — |
SecureDelegationPollingPeriod | — |
SignatureInceptionOffset | — |
Event ID 528 — Rollover was started on the type %1 with GUID %2 of zone %3.
Message
Fields
| Name | Description |
|---|---|
Type | — |
GUID | — |
Zone | — |
Event ID 529 — Rollover was completed on the type %1 with GUID %2 of zone %3.
Message
Fields
| Name | Description |
|---|---|
Type | — |
GUID | — |
Zone | — |
Event ID 530 — The type %1 with GUID %2 of zone %3 was marked for retiral.
Message
Fields
| Name | Description |
|---|---|
Type | — |
GUID | — |
Zone | — |
Event ID 531 — Manual rollover was triggered on the type %1 with GUID %2 of zone %3.
Message
Fields
| Name | Description |
|---|---|
Type | — |
GUID | — |
Zone | — |
Event ID 533 — The keys signing key with GUID %1 on zone %2 that was waiting for a Delegation Signer(DS) update on the parent has been forced to move to rollover ...
Message
Fields
| Name | Description |
|---|---|
GUID | — |
Zone | — |
Event ID 534 — DNSSEC setting metadata was exported %1 key signing key metadata from zone %2.
Message
Fields
| Name | Description |
|---|---|
WithWithout | — |
Zone | — |
Event ID 535 — DNSSEC setting metadata was imported on zone %1.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
Event ID 536 — A record of type %1, QNAME %2 was purged from scope %3 in cache.
Message
Fields
| Name | Description |
|---|---|
QTYPE | — |
QNAME | — |
Scope | — |
Event ID 537 — The forwarder list on scope %2 has been reset to %1.
Message
Fields
| Name | Description |
|---|---|
Forwarders | — |
Scope | — |
Event ID 540 — The root hints have been modified.
Message
Event ID 541 —
Message
Fields
| Name | Description |
|---|---|
Setting | — |
Scope | — |
NewValue | — |
Example Event
system:
provider: Microsoft-Windows-DNSServer
guid: EB79061A-A566-4698-9119-3ED2807060E7
event_source_name: ''
event_id: 541
version: 0
level: 4
task: 10
opcode: 0
keywords: 4611686018561605632
time_created: '2022-04-07T08:13:51.370506+00:00'
event_record_id: 5
correlation: {}
execution:
process_id: 2208
thread_id: 4676
channel: Microsoft-Windows-DNSServer/Audit
computer: WIN-FPV0DSIC9O6
security:
user_id: S-1-5-21-2121334350-1110938707-2888912545-500
event_data:
Setting: AdminConfigured
Scope: .
NewValue: '1'
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 542 — The scope %1 of DNS server was created.
Message
Fields
| Name | Description |
|---|---|
RecursionScope | — |
Event ID 543 — The scope %1 of DNS server was deleted.
Message
Fields
| Name | Description |
|---|---|
RecursionScope | — |
Event ID 544 — The DNSKEY with Key Protocol %2, Base64 Data %4 and Crypto Algorithm %5 has been added at the trust point %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
KeyProtocol | — |
BufferSize | — |
Base64Data | — |
CryptoAlgorithm | — |
Event ID 545 — The DS with Key Tag: %2, Digest Type: %3, Digest: %5 and Crypto Algorithm: %6 has been added at the trust point %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
KeyTag | — |
DigestType | — |
BufferSize | — |
Digest | — |
CryptoAlgorithm | — |
Event ID 546 — The trust point at %1 of type %2 has been removed.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Type | — |
Event ID 547 — The trust anchor for the root zone has been added.
Message
Event ID 548 — A request to restart the DNS server service has been received.
Message
Event ID 549 — The debug logs have been cleared from %1 on DNS server.
Message
Fields
| Name | Description |
|---|---|
FilePath | — |
Event ID 550 — The in-memory contents of all the zones on DNS server have been flushed to their respective files.
Message
Event ID 551 — All the statistical data for the DNS server has been cleared.
Message
Event ID 552 — A resource record scavenging cycle has been started on the DNS Server.
Message
Event ID 553 —
Message
Fields
| Name | Description |
|---|---|
EventString | — |
Event ID 554 — The resource record scavenging cycle has been terminated on the DNS Server.
Message
Event ID 555 — The DNS server has been prepared for demotion by removing references to it from all zones stored in the Active Directory.
Message
Event ID 556 — The information about the root hints on the DNS server has been written back to the persistent storage.
Message
Event ID 557 — The addresses on which DNS server will listen has been changed to %1.
Message
Fields
| Name | Description |
|---|---|
ListenAddresses | — |
Event ID 558 — An immediate RFC 5011 active refresh has been scheduled for all trust points.
Message
Event ID 559 — The zone %1 is paused.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
VirtualizationID | — |
Event ID 560 — The zone %1 is resumed.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
VirtualizationID | — |
Event ID 561 — The data for zone %1 has been reloaded from %2.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
FilePath | — |
VirtualizationID | — |
Event ID 562 — The data for zone %1 has been refreshed from the master server %2.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
MasterServer | — |
Event ID 563 — The secondary zone %1 has been expired and new data has been requested from the master server %2.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
MasterServer | — |
Event ID 564 — The zone %1 has been reloaded from the Active Directory.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
VirtualizationID | — |
Event ID 565 — The content of the zone %1 has been written to the disk and the notification has been sent to all the notify servers.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
VirtualizationID | — |
Event ID 566 — All DNS records at the node %1 in the zone %2 will have their aging time stamp set to the current time.
Message
Fields
| Name | Description |
|---|---|
NodeName | — |
Zone | — |
SubTreeAging | — |
Event ID 567 — The Active Directory-integrated zone %1 has been updated.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
ScavengeServers | — |
Event ID 568 — The key master role for zone %1 has been %2.
Message
Fields
| Name | Description |
|---|---|
Zone | — |
SeizedOrTransfered | — |
WithNewKeys | — |
Event ID 569 — A %1 signing key (%2) descriptor has been added on the zone %3 with following properties: KeyId=%4; KeyType=%5; CurrentState=%6; KeyStorageProvider...
Message
Fields
| Name | Description |
|---|---|
KeyOrZone | — |
KskOrZsk | — |
Zone | — |
KeyId | — |
KeyType | — |
CurrentState | — |
KeyStorageProvider | — |
StoreKeysInAD | — |
CryptoAlgorithm | — |
KeyLength | — |
DnsKeySignatureValidityPeriod | — |
DSSignatureValidityPeriod | — |
ZoneSignatureValidityPeriod | — |
InitialRolloverOffset | — |
RolloverPeriod | — |
RolloverType | — |
NextRolloverAction | — |
LastRolloverTime | — |
NextRolloverTime | — |
CurrentRolloverStatus | — |
ActiveKey | — |
StandbyKey | — |
NextKey | — |
Event ID 570 — A %1 signing key (%2) descriptor with GUID %3 has been updated on the zone %4.
Message
Fields
| Name | Description |
|---|---|
KeyOrZone | — |
KskOrZsk | — |
GUID | — |
Zone | — |
KeyId | — |
KeyType | — |
CurrentState | — |
KeyStorageProvider | — |
StoreKeysInAD | — |
CryptoAlgorithm | — |
KeyLength | — |
DnsKeySignatureValidityPeriod | — |
DSSignatureValidityPeriod | — |
ZoneSignatureValidityPeriod | — |
InitialRolloverOffset | — |
RolloverPeriod | — |
RolloverType | — |
NextRolloverAction | — |
LastRolloverTime | — |
NextRolloverTime | — |
CurrentRolloverStatus | — |
ActiveKey | — |
StandbyKey | — |
NextKey | — |
Event ID 571 — A %1 signing key (%2) descriptor %4 has been removed from the zone %3.
Message
Fields
| Name | Description |
|---|---|
KeyOrZone | — |
KskOrZsk | — |
Zone | — |
GUID | — |
Event ID 572 — The state of the %1 signing key (%2) %3 has been modified on zone %4.
Message
Fields
| Name | Description |
|---|---|
KeyOrZone | — |
KskOrZsk | — |
GUID | — |
Zone | — |
ActiveKey | — |
StandbyKey | — |
NextKey | — |
Event ID 573 — A delegation for %1 in the scope %2 of zone %3 with the name server %4 has been added.
Message
Fields
| Name | Description |
|---|---|
ChildZone | — |
Scope | — |
Zone | — |
NameServer | — |
VirtualizationID | — |
Event ID 574 — The client subnet with name %1, and value %2 has been added to the DNS server.
Message
Fields
| Name | Description |
|---|---|
ClientSubnetRecord | — |
ClientSubnetList | — |
Event ID 575 — The client subnet with name %1 has been deleted from the DNS server.
Message
Fields
| Name | Description |
|---|---|
ClientSubnetRecord | — |
Event ID 576 — The client subnet with name %1 has been updated on the DNS server.
Message
Fields
| Name | Description |
|---|---|
ClientSubnetRecord | — |
ClientSubnetList | — |
Event ID 577 — A server level policy %6 for %1 has been created on server %2 with following properties: Processing order:%3; Criteria:%4; Action:%5; Condition:%7;...
Message
Fields
| Name | Description |
|---|---|
Type | — |
ServerName | — |
ProcessingOrder | — |
Criteria | — |
Action | — |
Policy | — |
Condition | — |
IsEnabled | — |
Event ID 578 — A zone level policy %8 for %1 has been created on zone %6 on server %2 with following properties: Processing order:%3; Criteria:%4; Action:%5; Scop...
Message
Fields
| Name | Description |
|---|---|
Type | — |
ServerName | — |
ProcessingOrder | — |
Criteria | — |
Action | — |
ZoneName | — |
Scopes | — |
Policy | — |
Condition | — |
IsEnabled | — |
Event ID 579 — A policy %6 to control recursion settings has been created on server %2 with following properties: Processing order:%3; Criteria:%4; Action:%5; Sco...
Message
Fields
| Name | Description |
|---|---|
RecursionScope | — |
ServerName | — |
ProcessingOrder | — |
Criteria | — |
Action | — |
Policy | — |
Condition | — |
IsEnabled | — |
Event ID 580 — The server level policy %1 has been deleted from server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Event ID 581 — The zone level policy %1 has been deleted from zone %3 on server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Zone | — |
Event ID 582 — The policy %1 to control recursion settings has been deleted from server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Event ID 583 — The server level policy %1 has been updated on server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
OldPropertyValues | — |
NewPropertyValues | — |
Event ID 584 — The zone level policy %1 has been updated on zone %3 of server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Zone | — |
OldPropertyValues | — |
NewPropertyValues | — |
Event ID 585 — The server level policy %1 for recursion has been updated on server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
OldPropertyValues | — |
NewPropertyValues | — |
Event ID 586 — The zone level policy %1 has been updated on zone %4 of server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Scope | — |
Zone | — |
Event ID 587 — The zone level policy %1 has been updated on zone %5 of server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Scope | — |
ScopeWeight | — |
Zone | — |
Event ID 588 — The zone level policy %1 has been updated on zone %6 of server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
Scope | — |
ScopeWeightNew | — |
ScopeWeightOld | — |
Zone | — |
Event ID 589 — The server level policy %1 for recursion has been updated on server %2.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
ServerName | — |
NewScope | — |
OldScope | — |
Event ID 590 — The Response Rate Limiting is configured on the DNS server %1.
Message
Fields
| Name | Description |
|---|---|
ServerName | — |
ResponsePerSecond | — |
ErrorsPerSecond | — |
LeakRate | — |
TCRate | — |
WindowSize | — |
TotalResponsesInWindow | — |
IPv4PrefixLength | — |
IPv6PrefixLength | — |
Mode | — |
Event ID 591 — A exceptionlist %1 against response rate limiting has been added on the DNS server %2 with following settings: %3; Condition:%4.
Message
Fields
| Name | Description |
|---|---|
RRLExceptionlist | — |
ServerName | — |
Criteria | — |
Condition | — |
Event ID 592 — A exceptionlist %1 against response rate limiting has been deleted from server %2.
Message
Fields
| Name | Description |
|---|---|
RRLExceptionlist | — |
ServerName | — |
Event ID 593 — A exceptionlist %1 against response rate limiting has been updated on server %2.
Message
Fields
| Name | Description |
|---|---|
RRLExceptionlist | — |
ServerName | — |
OldPropertyValues | — |
NewPropertyValues | — |
Event ID 594 — The virtualization instance %1 with friendly name %2 was created.
Message
Fields
| Name | Description |
|---|---|
VirtualizationID | — |
FriendlyName | — |
Event ID 595 — The virtualization instance %1 was removed.
Message
Fields
| Name | Description |
|---|---|
VirtualizationID | — |
Event ID 596 — The virtualization instance %1 was updated.
Message
Fields
| Name | Description |
|---|---|
VirtualizationID | — |
OldFriendlyName | — |
NewFriendlyName | — |
Event ID 597 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
EdnsInfo | — |
Event ID 597 — QUERY_RECEIVED: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
RD | — |
QNAME | — |
QTYPE | — |
XID | — |
Port | — |
Flags | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
GUID | — |
EdnsInfo | — |
Event ID 598 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Destination | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
DNSSEC | — |
RCODE | — |
Port | — |
Flags | — |
Scope | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
DataTag | — |
ElapsedTime | — |
GUID | — |
EdnsInfo | — |
StaleRecordsPresent | — |
Event ID 598 — RESPONSE_SUCCESS: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Destination | — |
AA | — |
AD | — |
QNAME | — |
QTYPE | — |
XID | — |
DNSSEC | — |
RCODE | — |
Port | — |
Flags | — |
Scope | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
DataTag | — |
ElapsedTime | — |
GUID | — |
EdnsInfo | — |
StaleRecordsPresent | — |
Event ID 599 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Reason | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
Flags | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
EdnsInfo | — |
Event ID 599 — RESPONSE_FAILURE: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Reason | — |
Destination | — |
QNAME | — |
QTYPE | — |
XID | — |
RCODE | — |
Port | — |
Flags | — |
Zone | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
AdditionalInfo | — |
ElapsedTime | — |
GUID | — |
EdnsInfo | — |
Event ID 600 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
Reason | — |
Event ID 600 — IGNORED_QUERY: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
Reason | — |
Event ID 601 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
Reason | — |
Event ID 601 — IGNORED_QUERY: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
Reason | — |
Event ID 602 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
Port | — |
Flags | — |
Secure | — |
BufferSize | — |
PacketData | — |
Event ID 602 — DYN_UPDATE_RECV: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Source | — |
QNAME | — |
XID | — |
Port | — |
Flags | — |
Secure | — |
BufferSize | — |
PacketData | — |
Event ID 603 —
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
PolicyName | — |
BufferSize | — |
PacketData | — |
Event ID 603 — DYN_UPDATE_RESPONSE: Channel=.
Message
Fields
| Name | Description |
|---|---|
Channel | — |
ChannelInfo | — |
InterfaceIP | — |
Destination | — |
QNAME | — |
XID | — |
ZoneScope | — |
Zone | — |
RCODE | — |
PolicyName | — |
BufferSize | — |
PacketData | — |