# DNS log records do not have total\_answers, total\_queries, saw\_reply and saw\_query fields

**URL:** <https://community.zeek.org/t/dns-log-records-do-not-have-total-answers-total-queries-saw-reply-and-saw-query-fields/5596>\
**Category:** Zeek\
**Created:** [January 25, 2019, 8:27am UTC](https://community.zeek.org/t/dns-log-records-do-not-have-total-answers-total-queries-saw-reply-and-saw-query-fields/5596 "2019-01-25T08:27:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![redbaron](https://avatars.discourse-cdn.com/v4/letter/r/3bc359/32.png) [@redbaron](https://community.zeek.org/u/redbaron)\
**Post date:** [January 25, 2019, 8:27am UTC](https://community.zeek.org/t/dns-log-records-do-not-have-total-answers-total-queries-saw-reply-and-saw-query-fields/5596/1 "2019-01-25T08:27:08Z")

</div>

Hi,

I am running Bro/Zeek v 2.6.1.  
The fields logged in DNS logs are different from the ones shown in official docs (DNS::Info seen at [https://docs.zeek.org/en/stable/scripts/base/protocols/dns/main.bro.html#type-DNS::Info](https://docs.zeek.org/en/stable/scripts/base/protocols/dns/main.bro.html#type-DNS::Info)). Concretely, the last four fields (total\_answers, total\_queries, saw\_query and saw\_reply) fields are never part of the logs. This behaviour was seen in previous versions of Bro/Zeek as well (atleast from v.2.4).

I looked at the dns/main.bro script and can’t figure out why this is happening. Any ideas are greatly appreciated.

Regards,

Dheeraj

---

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [January 25, 2019, 4:44pm UTC](https://community.zeek.org/t/dns-log-records-do-not-have-total-answers-total-queries-saw-reply-and-saw-query-fields/5596/2 "2019-01-25T16:44:59Z")

</div>

The logs contain only fields with the &log attribute. Those fields do  
not have &log, so they are not in the logs.

- Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/dns-log-records-do-not-have-total-answers-total-queries-saw-reply-and-saw-query-fields/5596/3 "2022-05-06T15:46:19Z")

</div>