DNS: trigger logging for toserver dir when previous reply is lost.

src/log-dnslog.c

@@ -295,7 +295,7 @@ static TmEcode LogDnsLogIPWrapper(ThreadVars *tv, Packet *p, void *data, PacketQ
         }
     } else
 #endif
-    if ((PKT_IS_TOCLIENT(p))) {
+
     DNSTransaction *tx = NULL;
     for (; tx_id < total_txs; tx_id++)
     {
@@ -303,6 +303,10 @@ static TmEcode LogDnsLogIPWrapper(ThreadVars *tv, Packet *p, void *data, PacketQ
         if (tx == NULL)
             continue;
 
+        /* only consider toserver logging if tx has reply lost set */
+        if (PKT_IS_TOSERVER(p) && tx->reply_lost == 0)
+            continue;
+
         DNSQueryEntry *query = NULL;
         TAILQ_FOREACH(query, &tx->query_list, next) {
             LogQuery(aft, timebuf, dstip, srcip, dp, sp, tx, query);
@@ -325,7 +329,6 @@ static TmEcode LogDnsLogIPWrapper(ThreadVars *tv, Packet *p, void *data, PacketQ
         SCLogDebug("calling AppLayerTransactionUpdateLoggedId");
         AppLayerTransactionUpdateLogId(p->flow);
     }
-    }
 
 end:
     FLOWLOCK_UNLOCK(p->flow);