Is there any update to this discussion? Will someone work on this? Thanks. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Valdis.Kletnieks@vt.edu Sent: Tuesday, March 14, 2006 9:24 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] DOMAIN Name Variable On Tue, 14 Mar 2006 09:04:13 GMT, David Anderson said:
Rob,
Monday, March 13, 2006, 11:47:52 PM, you wrote:
that would be the TLD, yes: but i got the impression jason means 'domain' more like xyz.com foo.edu how.de
so therefore 'starting with the string before the last dot.'
That doesn't work, as many domains outside of the US have a 3-part domain, as in xyz.co.uk.
And even within the US, the number of levels in the domain are quite flexible. For instance, most of our hosts are of the form 'hostname.dept.vt.edu' - but in a few cases, we have only 3 levels (mostly central servers), and in others we have 5 levels - the CS department has a few hosts of the form 'hostname.project.cs.vt.edu' for some large long-term groups. The only sane definition is "everything between the *first* period and the *final* period" (yes, there's a (usually implicit) trailing period in there, and some DNS resolvers would consider that 'foo.cc.' was a domain under the 'cc' top-level domain, and 'foo.cc' was 'foo.cc.vt.edu'. And forgetting the trailing dot is a favorite way to hose up an entry in a BIND zone file. ;) echo ${FQDN} | cut -d. -f2- is what you want. THE INFORMATION CONTAINED IN THIS MESSAGE AND ANY ATTACHMENT MAY BE PRIVILEGED, CONFIDENTIAL, PROPRIETARY OR OTHERWISE PROTECTED FROM DISCLOSURE. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, copying or use of this message and any attachment is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and permanently delete it from your computer and destroy any printout thereof.