Abstract: In this paper, we investigate a logging model based on a complete DNS query event.The corresponding query/response matching technique is designed, equipped with a facility of memory caching to solve the performance bottleneck of the insertion operations.Furthermore, a mechanism of two-dimensional hash indexing with Bloom Filter is designed to improve searching and retrieving by reducing disk I/O.