doc/man1/djbdns-logparse.1: finish the tinydns transformation docs.

diff --git a/doc/man1/djbdns-logparse.1 b/doc/man1/djbdns-logparse.1
index b501cd167df288eb3504fc15a71b1fb896155188..5519032f3754d7f8297b981cc489891a721d2674 100644 (file)
--- a/doc/man1/djbdns-logparse.1
+++ b/doc/man1/djbdns-logparse.1
@@ -75,12 +75,37 @@ IPv6 addresses simply have colons interspersed, so that
 \(dq0000:0000:0000:0000:0000:ffff:7f00:0001\(dq.
 .IP \(bu
 Port numbers are converted from hexedecimal to decimal.
+.IP \(bu
+The query type id is converted to the corresponding RFC-defined type
+name, as in https://en.wikipedia.org/wiki/List_of_DNS_record_types.
+While dnscache logs the id in decimal, tinydns records it in
+hexadecimal (for example, \(dq001c\(dq) necessitating a hex->decimal
+conversion before we can look up its name.
+
 .P
 The following transformations are specific to tinydns:
 .IP \(bu 2
-The hexadecimal query type id (for example, \(dq001c\(dq) is converted
-first to decimal, and then to the corresponding RFC-defined type name,
-as in https://en.wikipedia.org/wiki/List_of_DNS_record_types
+If a query was dropped, the symbol (\-, I, C, /) indicating the reason
+is converted to English and wrapped in parentheses:
+.RS
+.TP
+.B \-
+(no authority)
+.TP
+.B I
+(invalid query)
+.TP
+.B C
+(invalid class)
+.TP
+.B /
+(couldn't parse)
+.RE
+.IP \(bu
+The request id (which was chosen by the client and sent with its
+request) is split off the end of the \(dqip:port:id\(dq triplet and is
+placed in parentheses with the word \(dqid\(dq, like \(dq(id
+8675309)\(dq.
 
 
 .SH BUGS