Configure Windows Domain Name Server

Enable DNS debug logging

If you want detailed DNS server statistics, enable debug logging on your DNS servers by following the instructions for your operating system:

• For Windows Server 2008 R2, see Select and enable debug logging options on the DNS server (http://technet.microsoft.com/en-us/library/cc759581%28v=ws.10%29.aspx) on MS TechNet. Note: This procedure works for Windows Server 2008 R2 even though the article shows that it is for Windows Server 2003 family operating systems as the procedure is the same.
• For Windows Server 2012 R2, see DNS Logging and Diagnostics (https://technet.microsoft.com/en-us/library/dn800669.aspx#dbug) on MS TechNet.

Impact of DNS debug logging on performance and license usage

When you enable debug logging on your DNS servers, you must consider the following caveats:

• If you enable DNS server debug logging, individual DNS server performance decreases significantly.

• Debug logging generates significant amounts of data that might exhaust disk space on your DNS servers, which can potentially cause downtime. You must watch and rotate your DNS server logs to prevent disk capacity issues from occurring.

• Debug logging also greatly increases the overall amount of data indexed by the Splunk App for Windows Infrastructure. Ensure that you have a Splunk license that can accommodate the additional indexing volume.

What's next?

You have configured the Windows DNS servers for debug logging. Next, you will install a universal forwarder on the DNS server and then deploy the Splunk Add-on for Windows DNS onto the client.