syslog-ng not resolving DNS names

noir911 · 07-23-2008, 09:18 PM

I am running syslog-ng 1.6.12 on OpenSUSE 10.3 & all the network switches that are logging in there are not resolving host name. They all log by IP address instead. But if I do nslookup from the logging server I can resolve the host names fine.

I have use_dns (yes); and use_fqdn (yes); in /etc/syslog-ng/syslog-ng.conf.
In /etc/resolv.conf I have added all my subdomain (like, switch.company.com, router.company.com etc.) and restarted syslog-ng daemon. I haven't restarted the network daemon though. I don't think I need to.

Does anyone know what I am doing wrong?

Thanks for any help.

acid_kewpie · 07-24-2008, 03:21 AM

can you show us proof that DNS is fully functional on the server in question and provide the full syslog-ng.conf?

noir911 · 07-28-2008, 03:02 AM

Quote:

Originally Posted by acid_kewpie

can you show us proof that DNS is fully functional on the server in question and provide the full syslog-ng.conf?

I am not sure how to show the proof that DNS is working. All I can say is that I do nslookup <host name> and it gives me answer from the DNS server.

Here's the full syslog-ng.conf

Quote:

options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (yes);
use_fqdn (yes);
create_dirs (no);
keep_hostname (yes);
stats (3600);
}

source s_sys {
unix-stream ( "/dev/log" );
internal();
};

source s_net { udp (); };

destination d_cons { file ( "/dev/console" ); };
destination d_mesg { file ( "/var/log/messages" ); };
destination d_auth { file ( "/var/log/secure" ); };
destination d_mail { file ( "/var/log/maillog" ); };
destination d_spol { file ( "/var/log/spooler" ); };
destination d_boot { file ( "/var/log/boot.log" ); };
destination d_cron { file ( "/var/log/cron" ); };
destination d_mlal { usertty ( "*" ); };
destination d_kern { file ( "/var/log/kern" ); };

filter f_mesg {
level ( info..emerg ) and not ( facility ( mail ) or facility ( authpriv ) or facility ( cron ) );
};
filter f_auth { facility ( authpriv ); };
filter f_mail { facility ( mail ); };
filter f_cron { facility ( cron ); };
filter f_emrg { level ( emerg ); };
filter f_spol { facility ( uucp ) or ( facility ( news ) and level ( crit ) ); };
filter f_boot { facility ( local7 ); };

log { source ( s_sys ); filter ( f_mesg ); destination ( d_mesg ); };
log { source ( s_sys ); filter ( f_auth ); destination ( d_auth ); };
log { source ( s_sys ); filter ( f_mail ); destination ( d_mail ); };
log { source ( s_sys ); filter ( f_cron ); destination ( d_cron ); };
log { source ( s_sys ); filter ( f_emrg ); destination ( d_mlal ); };
log { source ( s_sys ); filter ( f_spol ); destination ( d_spol ); };
log { source ( s_sys ); filter ( f_boot ); destination ( d_boot ); };

destination d_remote_logs {
file ( "/var/log/hosts/$FULLHOST"
# owner( root ) group( root ) perm ( 0600 ) dir_perm( 0700 ) create_dirs ( yes )
owner( root ) group( root ) perm ( 0644 ) dir_perm( 0744 ) create_dirs ( yes )
template ( "$DATE $FULLHOST $PROGRAM $TAG [$FACILITY.$LEVEL] $MESSAGE\n" ) );
};

log { source ( s_net ); destination ( d_remote_logs ); };
log { source ( s_sys ); destination ( d_remote_logs ); };

Thanks for any help.