<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello there,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’ve got a little trouble with the DNS resolving of syslog-ng. Last week I patched my syslog installation with the threaded dns bugfix (</span><a href="https://bugzilla.balabit.com/show_bug.cgi?id=212"><span lang="EN-US">https://bugzilla.balabit.com/show_bug.cgi?id=212</span></a><span lang="EN-US">)
and it seems like most of my problems are gone but one is still remaining. <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Many times a day messages are sorted into a folder with the DNS name of my syslog-ng server instead of the real host where the log is coming from. The log line still has the right host in the text and most of the time
it is working but I could not find any way to reproduce the problem on demand yet. For debugging I’ve disabled any logging for the server itself but it still happens.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">My destinations are configured like this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">destination d_syslog { file("/log/syslog/${R_YEAR}/${R_MONTH}/${R_DAY}/$FULLHOST_FROM/$PROGRAM" template(t_plain)); };<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">And my dns options:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> use_fqdn(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dns_cache(yes);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dns_cache_size(16384);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dns_cache_expire(300);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> dns_cache_expire_failed(10);<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I’ve tried disabling the syslog-ng cache,installing a local caching bind and after that a nscd but with no success. With 750 servers sending 30k-40k logs per second the dns querys are too expensive and I need the internal
syslog-ng caching. With local bind caching the logs per second are dropping down to 2500.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Does anybody has an idea to fix this?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">Daniel Neubacher, Network Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE"><a href="mailto:daniel.neubacher@xing.com"><span style="color:blue">daniel.neubacher@xing.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">XING AG<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">Gaensemarkt 43, 20354 Hamburg, Germany<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">Tel. +49 40 419131-28, Fax +49 40 419131-11<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:DE">Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:DE">Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:DE"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:DE">This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and
destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>