<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:inherit;
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Sorry for asking the basic, "have you turned it off and on again" question, but have you checked /etc/nsswitch.conf to make sure it's set to use hosts first?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="359" style="width:269.15pt;border-collapse:collapse">
<tbody>
<tr style="height:79.65pt">
<td width="104" style="width:78.0pt;border:none;border-right:solid #F7751F 2.25pt;padding:0in 5.25pt 0in 0in;height:79.65pt">
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:inherit;color:#555555"><img width="97" height="97" style="width:1.0104in;height:1.0104in" id="Picture_x0020_4" src="cid:image001.png@01D433B7.59774F10" alt="cid:image001.png@01D3FCD9.6DFA7670"></span><i><span style="font-size:9.0pt;color:black">First
they'll say it's impossible, then they'll say it was inevitable</span></i><span style="font-size:12.0pt;font-family:inherit;color:#555555"><o:p></o:p></span></p>
</td>
<td valign="bottom" style="padding:0in 0in 0in 9.0pt;height:79.65pt">
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="296" style="width:221.7pt;border-collapse:collapse">
<tbody>
<tr style="height:10.15pt">
<td colspan="2" valign="bottom" style="padding:0in 0in 3.75pt 0in;height:10.15pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Arial",sans-serif;color:#F7751F">Clayton Dukes<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:9.1pt">
<td colspan="2" valign="bottom" style="padding:0in 0in 0in 0in;height:9.1pt">
<p class="MsoNormal"><b><span style="font-size:10.5pt;font-family:inherit;color:#333333;border:none windowtext 1.0pt;padding:0in">CEO</span></b><b><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333"><o:p></o:p></span></b></p>
</td>
</tr>
<tr style="height:8.65pt">
<td colspan="2" valign="bottom" style="padding:0in 0in 0in 0in;height:8.65pt">
<p class="MsoNormal"><b><span style="font-size:10.5pt;font-family:inherit;color:#333333;border:none windowtext 1.0pt;padding:0in">LogZilla Corp</span></b><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333"><o:p></o:p></span></p>
</td>
</tr>
<tr style="height:8.15pt">
<td width="24" valign="top" style="width:18.05pt;padding:0in 0in 0in 0in;height:8.15pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#F7751F">m:<o:p></o:p></span></p>
</td>
<td valign="bottom" style="padding:0in 0in 0in 0in;height:8.15pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">936-4NetOps (463-8677)<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:16.4pt">
<td width="24" valign="top" style="width:18.05pt;padding:0in 0in 0in 0in;height:16.4pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#F7751F">a:<o:p></o:p></span></p>
</td>
<td valign="top" style="padding:0in 0in 0in 0in;height:16.4pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">2900 N. Quinlan Park Rd, B240-341<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">Austin, TX 78732<o:p></o:p></span></p>
</td>
</tr>
<tr style="height:9.1pt">
<td width="24" valign="top" style="width:18.05pt;padding:0in 0in 0in 0in;height:9.1pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#F7751F">w:<o:p></o:p></span></p>
</td>
<td valign="top" style="padding:0in 0in 0in 0in;height:9.1pt">
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:inherit;color:#333333;border:none windowtext 1.0pt;padding:0in"><a href="https://www.logzilla.net/"><span style="color:#0563C1">logzilla.net</span></a></span><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333"> </span><span style="font-size:10.5pt;font-family:inherit;color:#F7751F;border:none windowtext 1.0pt;padding:0in">e: </span><span style="font-size:10.5pt;font-family:inherit;color:#333333;border:none windowtext 1.0pt;padding:0in"><a href="mailto:cdukes@logzilla.net"><span style="color:#0563C1">cdukes@logzilla.net</span></a></span><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333"><o:p></o:p></span></p>
</td>
</tr>
<tr style="height:14.0pt">
<td colspan="2" valign="bottom" style="padding:3.75pt 0in 0in 0in;height:14.0pt">
<p class="MsoNormal"><a href="https://twitter.com/logzilla"><span style="font-family:inherit;color:#1DA1DB;border:none windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="25" height="25" style="width:.2604in;height:.2604in" id="Picture_x0020_3" src="cid:image002.png@01D433B7.59774F10" alt="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/twitter_sig.png"></span></a><span style="font-family:inherit"> </span><a href="https://www.linkedin.com/in/lzcdukes/"><span style="font-family:inherit;color:#1DA1DB;border:none windowtext 1.0pt;padding:0in;text-decoration:none"><img border="0" width="25" height="25" style="width:.2604in;height:.2604in" id="Picture_x0020_2" src="cid:image003.png@01D433B7.59774F10" alt="http://cdn2.hubspot.net/hubfs/184235/dev_images/signature_app/linkedin_sig.png"></span></a><span style="font-family:inherit"><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td width="3" style="width:2.5pt;padding:0in 0in 0in 0in;height:79.65pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
</tr>
<tr>
<td width="359" colspan="3" valign="bottom" style="width:269.15pt;padding:0in 0in 0in 0in">
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="528" style="width:5.5in;border-collapse:collapse">
<tbody>
<tr style="height:.4in">
<td width="3%" style="width:3.94%;border-top:solid windowtext 1.0pt;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:none;padding:0in 5.4pt 0in 5.4pt;height:.4in">
<p class="MsoNormal" align="center" style="text-align:center"><img border="0" width="29" height="29" style="width:.302in;height:.302in" id="Picture_x0020_1" src="cid:image004.png@01D433B7.59774F10" alt="cid:image004.png@01D41528.4B573AB0"><o:p></o:p></p>
</td>
<td width="96%" style="width:96.06%;border-top:solid windowtext 1.0pt;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:none;padding:0in 5.4pt 0in 5.4pt;height:.4in">
<p class="MsoNormal"><span style="background:white">The LogZilla platform provides unpreceded scale, data enrichment and automation for NetOps and SecOps teams freeing up millions in IT’s budget</span>.<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Jim Hendrick <james.r.hendrick@gmail.com><br>
<b>Reply-To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Date: </b>Monday, August 13, 2018 at 2:37 PM<br>
<b>To: </b>Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject: </b>Re: [syslog-ng] Hosts before DNS<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have used HOST_FROM to get the IP of the sending server. Might help and it saves a name lookup.
<o:p></o:p></p>
<div>
<p class="MsoNormal">Jim<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Aug 13, 2018, 2:24 PM Oleg <<a href="mailto:olegr06@gmail.com">olegr06@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I am using the latest version of ose ng, and have an issue I am trying to resolve. We have hosts that resolve to multiple names via round robin dns. So ng is capturing logs from all of those,
depending on how it was resolved during during the connection. For those types of hosts, I would like to configure ng to use hosts first, and fall back to dns resolution. Tried different combinations of configs, but it does not work this way. It either
uses the hosts, or it does dns lookup. Thanks in advance for any tips on resolving this.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Example: <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">10.0.0.1 resolve to www, app1, ftp<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">I want to call it webserver in /etc/hosts, and if the entry matches, ng would just use that name. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">right now it creates 3 separate log files for the same host based on the name it's able to resolve at lookup.<o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">______________________________________________________________________________<br>
Member info: <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7Cad4b9ebad2614f3f83ea08d6014be142%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636697822756913887&sdata=1bkTAz4ZQ6SbP%2BcUw5UroOpcYYcQMomTwXnGK2sJlQ8%3D&reserved=0" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7Ccdukes%40logzilla.net%7Cad4b9ebad2614f3f83ea08d6014be142%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636697822756923891&sdata=Un30FT8qROGeS5tJbCa78lZ1xuzQ5bte46%2F9x7RsSug%3D&reserved=0" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7Ccdukes%40logzilla.net%7Cad4b9ebad2614f3f83ea08d6014be142%7C17fac5c255634489bef45cda2e65588f%7C0%7C0%7C636697822756923891&sdata=bhvIMm77dtLVu6ZFqNJ3%2BT26%2BoddijiScnyKBoi8afQ%3D&reserved=0" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>