From: Michael Orlitzky <michael@orlitzky.com>
Date: Tue, 20 Sep 2022 01:12:50 +0000 (-0400)
Subject: doc/man1/djbdns-logparse.1: finish the tinydns transformation docs.
X-Git-Tag: 0.0.1~18
X-Git-Url: http://gitweb.michael.orlitzky.com/?p=djbdns-logparse.git;a=commitdiff_plain;h=b92f64a49cd6ae8ba2210df02810ede43eb370fe

doc/man1/djbdns-logparse.1: finish the tinydns transformation docs.
---

diff --git a/doc/man1/djbdns-logparse.1 b/doc/man1/djbdns-logparse.1
index b501cd1..5519032 100644
--- a/doc/man1/djbdns-logparse.1
+++ b/doc/man1/djbdns-logparse.1
@@ -75,12 +75,37 @@ IPv6 addresses simply have colons interspersed, so that
 \(dq0000:0000:0000:0000:0000:ffff:7f00:0001\(dq.
 .IP \(bu
 Port numbers are converted from hexedecimal to decimal.
+.IP \(bu
+The query type id is converted to the corresponding RFC-defined type
+name, as in https://en.wikipedia.org/wiki/List_of_DNS_record_types.
+While dnscache logs the id in decimal, tinydns records it in
+hexadecimal (for example, \(dq001c\(dq) necessitating a hex->decimal
+conversion before we can look up its name.
+
 .P
 The following transformations are specific to tinydns:
 .IP \(bu 2
-The hexadecimal query type id (for example, \(dq001c\(dq) is converted
-first to decimal, and then to the corresponding RFC-defined type name,
-as in https://en.wikipedia.org/wiki/List_of_DNS_record_types
+If a query was dropped, the symbol (\-, I, C, /) indicating the reason
+is converted to English and wrapped in parentheses:
+.RS
+.TP
+.B \-
+(no authority)
+.TP
+.B I
+(invalid query)
+.TP
+.B C
+(invalid class)
+.TP
+.B /
+(couldn't parse)
+.RE
+.IP \(bu
+The request id (which was chosen by the client and sent with its
+request) is split off the end of the \(dqip:port:id\(dq triplet and is
+placed in parentheses with the word \(dqid\(dq, like \(dq(id
+8675309)\(dq.
 
 
 .SH BUGS