DNS Debug logs have the period in the domain name substituted by a number in parenthesis. (4267142)

DNS Debug logs have the period in the domain name substituted by a number in parenthesis.

In the following example you would normally expect to see the highlighted text showing

safebrowsing.googleapis.com

and

EXAMPLE.COM

But instead you get

(12)safebrowsing(10)googleapis(3)com(0)

and

(7)EXAMPLE(3)COM(0)

This is by design.

In the DNS debug log the field with the parenthesis ‘(*)’ substituting the period ‘(.)’ is called the ‘Question Name’ and the content of this field is called the QNAME (Query Name).

This is detailed in RFC 1035

https://tools.ietf.org/html/rfc1035

++++++++++++++++++++
QNAME               

a domain name represented as a sequence of labels, where

each label consists of a length octet followed by that

number of octets. The domain name terminates with the

zero length octet for the null label of the root. Note

that this field may be an odd number of octets; no

padding is used.

1. Leave as is. What is displayed in the debug log is correct and not caused by some rogue substitution rule.

2. However, you could search for any word that appears at the end of the log and ends with ‘(0)’. Then using the subst() rewrite tool do a search and replace for all instances of ‘(*)’ in the selected word.
   See the section in the Admin Guide called ‘Manipulating Messages’ for more details on how to go about this.
   https://support.oneidentity.com/technical-documents/syslog-ng-premium-edition/7.0.21/administration-guide/69#TOPIC-1487425

3. If you need to make this change then ideally you should see if you can make the change in the DNS debug file on the Windows server before you send it to your syslog server. Please refer to the relevant Microsoft documentation or contact Microsoft support.