That did it! Thank you. Somehow "bridge" got included in the hosts file on the 127.0.0.1 line. I must have done it, but don't know why I would have ever done such a thing. Simply removing bridge from the line and restarting syslog-ng corected the problem. I looked right at it earlier and didn't see it. Thanks again for your help and your patience. Lee -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, December 01, 2010 7:16 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] hostname incorrect after upgrade to 3.1.2 On Tue, 2010-11-30 at 11:55 -0500, w3euu wrote:
OK. I've attached another strace. This one looks better. Sorry for the fumbled attempt earlier And thank you for the hint.
Let me quickly review the situation.
I have upgraded 6 systems from syslog-ng (OSE) 3.1.1 to 3.1.2 and then to 3.1.3. All went well. Five of the systms work great (including the central logging machine.) On the sixth system (hostname = bridge) syslog-ng doesn't pick up the system's hostname but instead syslog-ng reports the hostname as "locallhost." I proved that the error is occuring on "bridge" by running tcpdump on bridge. The tcpdump output provided yesterday shows the hostname "localhost" in the tcp output stream from bridge. Bridge reports its own hostname correctly using the hostname command, its reverse dns reports its hostname correctly and there is nothing in the hosts file that should create this problem.
The problem is that "bridge" as a hostname is listed for the 127.0.0.1 address and there the fully-qualified-name is "localhost.localdomain". There was a change in syslog-ng, to use DNS and /etc/hosts to determine the local hostname, since /etc/hostname usually has no FQDN. So, the solution is to add an entry to /etc/hosts with the local IP address and the FQDN of bridge and the hostname. -- Bazsi ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html