MicrosoftThis is excellent information and I cannot wait for certain Gartner Magic Quadrant SIEM "leaders" to stop insisting we need to enable text DNS debug logs for their product to work. Everything they require seems to be available in the main DNS event log or analytic log - all they need to do is develop the add-on to digest the thing properly and advise their customers to enable the analytic log as a prerequisite.
We have definitely seen performance impacts from enabling the legacy log. I have also personally run into the issue where the debug log rollover fills up disk space after configuring it per the SIEM vendor's instructions (and the hazy documentation on the Microsoft side as to how the log rollover feature works). The debug log is also fussy about being moved (especially if to a different partition to the Windows installation) and if the slightest thing goes wrong with it, it nukes your DNS server (and thereby your domain controller, if running on a DC), as alluded to above. There is obviously some kind of checkpointing mechanism that gets very upset if the log file isn't as expected - it's not a feature that should be casually messed with.
