-
-
Save phyoewaipaing/6fe67f5b5869bfdc53791cb57f6f75c2 to your computer and use it in GitHub Desktop.
Parse_DNS_Debug_Log
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<# | |
.SYNOPSIS | |
Script parse the Server 2012/2016/2019 DNS debug log file of into clear Readable format (Datetime, IP Address and FQDN) | |
.DESCRIPTION | |
** This script will filter the ' UDP Rcv ' lines and output the DNS Debug file into Datetime, IP Address and queried DNS name. Columns headers explained as follow: | |
Datetime => Datetime stamp when query was made | |
IP Address => Source IP Address of the client | |
FQDN => Fully Qualified Domain Name of the request | |
** This script will take some some to process large files. The estimated duration is ~1min for 100 MB file. | |
** User is prompted with estimated duration before processing file. But it all depends on your compute machine resources. | |
** The output file name be appended by "_Parsed.txt" where you can rename it to My_DNS_Debug_Parsed.csv if needed. | |
** This script uses Array List, .Net class and avoid Export-Csv for gaining better performance when processing large text files. | |
** [Warning]: This script uses certain amount of host's CPU and Memory for processing text file. So, I do not recommend to run this script on Domain Controllers/ DNS Servers or hosts where resources are limited. | |
Example usage: | |
Parse_DNS_Debug_Log.ps1 -DebugFile "C:\MyFolder\DnsDebug.txt" | |
Author: Phyoe Wai Paing | |
Country: Myanmar(Burma) | |
Last Modified: 19.Sep.2020 | |
Initial Release: v1.0 : 15.Sep.2020 | |
v.1.1: 19.Sep.2020 : Add the timer and output the number of processed records & processing time. | |
.EXAMPLE | |
Parse_DNS_Debug_Log.ps1 -DebugFile "C:\MyFolder\DnsDebug.txt" | |
This will parse the DNS Debug file named "C:\MyFolder\DnsDebug.txt". Output file name will be "C:\MyFolder\DnsDebug_Parsed.txt" | |
.PARAMETER DebugFile | |
Location of the debug log file. You can specify the file in the current directory or full file path. | |
.LINK | |
You can find this script and more at: https://www.sysadminplus.blogspot.com/ | |
#> | |
Param([string]$DnsFilePath) | |
If (Test-Path $DnsFilePath) | |
{ | |
$FileInfo = Get-ChildItem -Path $DnsFilePath | |
$Duration = [TimeSpan]::FromMilliseconds([math]::round((250260/272205628 * $FileInfo.Length),0)) ## I just put the average duration for 1 byte of file size, multiply by total file size | |
If ($Duration.TotalSeconds -gt 10 -AND $Duration.TotalSeconds -lt 60) { | |
Write-Host "File size is $([math]::round($FileInfo.Length/1MB,1)) MB." | |
Write-Host "It will take less than 1 minute for operation." | |
} | |
elseif ($Duration.TotalSeconds -gt 60) { | |
Write-Host "File size is $([math]::round($FileInfo.Length/1MB,1)) MB." | |
Write-Host "It may take $($Duration.Minutes) minutes for operation." | |
} | |
else { | |
Write-Host "File size is $([math]::round($FileInfo.Length/1KB)) KB." | |
$SkipLines = 1; | |
} | |
$Ans = Read-Host "Do you want to continue(y/n)?" | |
If ($Ans -eq 'y') | |
{ | |
If (!($SkipLines)) { Write-Host "Processing..."; } | |
$i = 0; ## Set to count the number of records; | |
$Timer= [Diagnostics.Stopwatch]::StartNew() ## Start the timer | |
$ArrayOfStrings = [System.Collections.ArrayList]@() | |
Switch -regex ([System.IO.File]::ReadLines($FileInfo.fullname)) { | |
' UDP Rcv ' { | |
$Datetime = [regex]::matches($switch.current,'\d{1,2}/\d{1,2}/\d{4} \d{1,2}:\d{1,2}:\d{1,2} (AM|PM)').Value | |
$IP = [regex]::matches($switch.current,'\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b').Value | |
$FQDN = [regex]::matches($switch.current,"\)[A-z0-9-_]*\(").Value -replace "\)|\(","" -join "." | |
[void]$ArrayOfStrings.Add("$Datetime,$IP,$FQDN") | |
$i++; | |
} | |
} | |
$OutFilePath = "$($FileInfo.DirectoryName)\$($FileInfo.BaseName)_Parsed.txt" | |
[System.IO.File]::WriteAllLines($OutFilePath, $ArrayOfStrings) | |
$Timer.stop() | |
Write-host "Total time elapsed: $($Timer.Elapsed.ToString('hh\:mm\:ss\.ff'))" | |
Write-Host "Number of Record Processed: $i" | |
Write-Host "Parsed File created successfully at $OutFilePath" | |
} | |
else | |
{ Write-Host "Script exits." } | |
} | |
Else | |
{ | |
Write-Host -fore Red "File does not exist in the following location: $DnsFilePath. Script exits." | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
i think the usage is in fact "Parse_DNS_Debug_Log.ps1 -DnsFilePath "C:\MyFolder\DnsDebug.txt". In the example you use the switch "Debugfile", but it is in fact "DnsFilePath"