<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>> Hello there,
<br>> My syslog-ng is logging fine from 700 servers but a few times per day it
<br>> is logging into a wrong folder which is created by the $HOST variable.
<br>> Normally syslog should use a hostname like host-1.worker.foobar.com but
<br>> a few times a day it creates a folder names like:
<br>>
<br>> 4.22
<br>> p6-allrouter?
<br>> p6-localnet
<br>> p6-mc?
<br>> p6-mcastpref
<br>> p6-mcastpref?
<br>> host-1.worker.foobar.xcom
<br>> and other weird names...
<br>>
<br>> It only logs one or two lines and then uses the right folder again. Does
<br>> anyone have a clue where I have to look for the problem?
<br>>
<br>> Here are the option line from the server and the client:
<br>>
<br>> Client:
<br>> @version: 3.3
<br>> options {
<br>>  threaded(yes);
<br>>
<br>>  use_dns(yes);
<br>>  use_fqdn(yes);
<br>>  dns_cache(yes);
<br>>  dns_cache_size(16384);
<br>>  dns_cache_expire(3600);
<br>>  dns_cache_expire_failed(10);
<br>>
<br>>  log_msg_size(256000);
<br>>  log_fifo_size(100000);
<br>>
<br>>  normalize_hostnames(yes);
<br>>  check_hostname(yes);
<br>>  bad_hostname("^gconfd$");
<br>>
<br>>  create_dirs(yes);
<br>>  owner("root");
<br>>  group("root");
<br>>  perm(0640);
<br>>
<br>>  time_reopen(30);
<br>> };
<br>>
<br>> Server:
<br>>
<br>> options {
<br>>  threaded(yes);
<br>>  owner("root");
<br>>  group("root");
<br>>  perm(0660);
<br>>
<br>>  dir_owner("root");
<br>>  dir_group("root");
<br>>  dir_perm(0770);
<br>>  create_dirs(yes);
<br>>
<br>>  chain_hostnames(no);
<br>>  normalize_hostnames(yes);
<br>>  check_hostname(yes);
<br>>  keep_hostname(no);
<br>>
<br>>  use_fqdn(yes);
<br>>  dns_cache(yes);
<br>>  dns_cache_size(16384);
<br>>  dns_cache_expire(3600);
<br>>  dns_cache_expire_failed(60);
<br>>
<br>>  log_msg_size(256000);
<br>>  log_fifo_size(1000000);
<br>> };
<br>>
<br>> Destination example:
<br>> destination d_syslog {
<br>> file("/log/syslog/${R_YEAR}/${R_MONTH}/${R_DAY}/$HOST/$PROGRAM"); };
<br>
<br>keep-hostname() is false in your case, which means it resolves hostnames from dns and /etc/hosts
<br>
<br>Isn't it possible that you get ipv6 traffic from special addresses, and those are resolved onto the names it uses?
<br>
<br>can you run tcpdump on the server to confirm? do you have ipv6 source configured?</p>
</body>
</html>