Can GTM log DNS queries; where are the logs shown?

Short answer

Yes. When the Log switch (default Disabled) in the DNS Service form is turned on, the service writes the incoming DNS queries to its own process record; these query lines are not listed on a log screen in the interface. In the interface, query traffic is monitored with aggregate metrics: the DNS Service Dashboard and the domain name and record dashboards show the query rate, the response codes, the record type, the client country and the number of queries per domain or record. The GTM Logs screen, on the other hand, keeps not individual queries but GTM's decisions (health check, scenario, record status, trigger, AXFR, data center access) and user operations; these logs can be forwarded to a Syslog server with Log Forwarding.

How Does It Work?

What is recorded	Where it is turned on	Where it is seen
Individual DNS queries	The Log switch in the DNS Service form; per service	The service's own process record; not listed in the interface. The Log column in the Service Management list shows the state of the switch (Enabled / Disabled)
Query metrics	Always on	Dashboard, domain name dashboard, record dashboard, Home → GTM
GTM events and user operations	Always on	GTM Logs and the Log window in the preview of the objects

The main event types in GTM Logs: Health Check Status, Health Scenario Status, Record State, Domain/Record Status, Trigger Action, Internet Status, WAN Access Status, LAN Status, AXFR Action and User Action (GTM Log Event Types).

In TR7

• For the query distribution: The Country Distribution tab of the Dashboard shows the client country, the Query Types tab the record type, the Domains & Records tab the number of queries per domain and record, and the System tab the error panels (View Tabs).
• Using GTM Logs: Settings → System Logs → GTM Logs; a time range and Log Limit (default 1000) are selected, the logs are fetched with Get Logs and filtered with Log Type and Username. The list does not refresh by itself.
• Forwarding to an external system: GTM Logs is selected in the Log Sources field of the Log Forwarding profile.
• Cluster: The Log switch is a service setting and is also transferred to the peer device; in GTM Logs, the Source column shows on which device the event was generated.

Common Misconceptions

• "When Log is turned on, the queries appear on the GTM Logs screen." GTM Logs lists only GTM events and user operations.
• "Log must be turned on to see from which country and to which record queries come." These distributions are seen on the Dashboard and on the domain name / record dashboards even while Log is off.
• "Log Forwarding sends DNS queries to the SIEM." The GTM source that is sent in the Log Sources list is GTM Logs; individual queries are not included in this source.

How it is done in the documentation

• Service Management · Log
• GTM Logs · What Is GTM Logs?
• GTM Logs · GTM Log Event Types
• Dashboard · View Tabs
• Log Forwarding · Log Sources

Related questions

• Which monitoring screens does GTM have; what does each one show?
• What is a DNS Service in GTM?
• How does a Health Check result affect the DNS answer?