Common Event Log Messages

The Microsoft DNS Server logs events to the System Log. To view the events, use the Event Viewer, which you start with Start Programs Administrative Tools Event Viewer. The DNS server logs to a special category called, appropriately enough, DNS Server. Make sure you're looking at the correct log messages by selecting DNS Serverin the left pane. To save space, when we describe an event we won't show a screen shot of the complete event. Instead, we'll list just the description from the event detail. (Double-click an event to see its details.) We'll also list the Event ID in parentheses after the text of the event.

When the server starts up (either at boot time or because you restarted it) and is ready to answer queries, you'll see this event:

The DNS Server has started. (ID 2)

For a healthy server, you should see this event after booting. If you stop the server manually, you'll see this event:

If a server is a slave for a zone, it will notify you every time it performs a zone transfer:

A more recent version, version 2000120500 of zone movie.edu was found at DNS server

at 192.249.249.3. Zone transfer is in progress. (ID 6522)

The DNS server wrote version 2000120500 of zone movie.edu to file movie.edu.dns.

(ID 3150)

You'll also see that last message on the primary master when you make a change to a zone through the DNS console and select Action Update Server Data Files. After the server writes the updated file to disk, it logs that event.

If the primary master is not authoritative for the zone—another error condition— you'll see this on the slave:

Zone transfer request for secondary zone movie.edu refused by master server at 192.

249.249.3. Check the zone at the master server 192.249.249.3 to verify that zone

transfer is enabled to this server. To do so, use the DNS console, and select master

server 192.249.249.3 as the applicable server, then in secondary zone movie.edu

Properties, view the settings on the Zone Transfers tab. Based on the settings you

choose, make any configuration adjustments there (or possibly in the Name Servers

tab) so that a zone transfer can be made to this server. (ID 6525)

Unfortunately, if the name server simply can't reach the primary master (e.g., if it has gone down), the DNS server never logs an error.

On the other hand, a server that's a primary master for a zone will notify you when a slave does a zone transfer:

The DNS server successfully completed transfer of zone movie.edu to DNS server at

192.249.249.1. (ID 6001)

If you're missing the cache file, cache.dns, or a zone data file, the server will log a flurry of messages. A missing or empty cache file produces these events:

The DNS server could not open the file dns\cache.dns. Check that the file exists in

the %SystemRoot%\System32\Dns directory and that it contains valid data. The event

data is the error code. (ID 1000)

The DNS server could not find or open zone file dns\cache.dns. in the %SystemRoot%\

System32\Dns directory. Verify that the zone file is located in this directory and

The DNS server is not root authoritative and no root hints were specified in the

cache.dns file.

Where the server is not a root server, this file must specify root hints in the form

of at least one name server (NS) resource record, indicating a root DNS server and a

corresponding host (A) resource record for that root DNS server. Otherwise, the DNS

server will be unable to contact the root DNS server on startup and will be unable to

answer queries for names outside of its own authoritative zones. To correct this

problem, use the DNS console to update the server root hints. For more information,

see the online Help. (ID 707)

The DNS server does not have a cache or other database entry for root name servers.

Either the root hints file, cache.dns, or Active Directory must have at least one

name server (NS) resource record, indicating a root DNS server and a corresponding

host (A) resource record for that root DNS server. Otherwise, the DNS server will be

unable to contact the root DNS server on startup and will be unable to answer queries

for names outside of its own authoritative zones. To correct this problem, use the

DNS console to update the server root hints. For more information, see the online

Help. (ID 706)

The somewhat cryptic message "The event data is the error code" makes more sense when viewing the message in Event Viewer. This message means there's a specific error code listed in the Data field at the bottom of the Event Properties window for this event.

A missing zone data file, say movie.edu.dns, generates these events:

The DNS server could not open the file dns\movie.edu.dns. Check that the file exists

in the %SystemRoot%\System32\Dns directory and that it contains valid data. The event

data is the error code. (ID 1000)

The DNS server could not find or open zone file dns\movie.edu.dns. in the

%SystemRoot%\System32\Dns directory. Verify that the zone file is located in this

directory and that it contains valid data. (ID 1004)

The server also logs a syntax error in a zone data file. If you always make changes to your zones using the DNS console, you shouldn't see syntax errors. Editing by hand can get you into trouble, though. Here's what happens when the server encounters a syntax error:

The DNS server unexpected end of line, in zone file movie.edu.dns at line 5. To

correct the problem, fix this line in the zone file, which is located in the

%SystemRoot%\System32\Dns directory. (ID 1505)

The DNS server is ignoring an invalid resource record in zone file movie.edu.dns at

line 5.

See the previously logged event for a description of the error. Although the DNS server continues to load, ignoring this RR, it is recommended that

you investigate the error associated with this record and either correct it or remove

it from the zone file. (ID 1508)

If you put an invalid IP address (such as an IP address not corresponding to a network interface on the server) in the DNSServerIPAddresses field of the Server

PropertiesInterfaces window, you'll see this:

The DNS server list of restricted interfaces contains IP addresses that are not

configured for use at the server computer.

Use the DNS manager server properties, interfaces dialog, to verify and reset the IP

addresses the DNS server should listen on. For more information, see "To restrict a

DNS server to listen only on selected addresses" in the online Help. (ID 409)

Note that the server will not receive queries sent to the wildcard address 0.0.0.0. For a list of most of the events logged by a Microsoft DNS Server, see article Q259302 in the Microsoft Knowledge Base:

http://support.microsoft.com/support/kb/articles/Q259/3/02.ASP.