Resolving host IPs on the central log server
My setup is pretty simple: I have a number of local syslog-ng "collectors" feeding into one central syslog-ng server. All systems are running syslog-ng 2.0.7. I'd like to optimize the collectors for speed and thus not attempt to resolve hostnames there, but rather pass the syslog message raw to the central log server who then performs the IP->DNS translation and writes the message to disk. I've experimented with the various dns_* options to no avail, as it seems like syslog-ng wants to either resolve the hostname at the collector, or not at all. Am I missing something simple here, or is this not possible with 2.0.7? Thanks for your help. Steve -- Steve Bernacki, Jr To date, the Pan-Massachusetts Challenge has raised 204 million dollars for cancer research. Get involved! http://www.pmc.org/
On Sun, 2008-01-20 at 14:08 -0500, Steve Bernacki wrote:
My setup is pretty simple: I have a number of local syslog-ng "collectors" feeding into one central syslog-ng server. All systems are running syslog-ng 2.0.7. I'd like to optimize the collectors for speed and thus not attempt to resolve hostnames there, but rather pass the syslog message raw to the central log server who then performs the IP->DNS translation and writes the message to disk. I've experimented with the various dns_* options to no avail, as it seems like syslog-ng wants to either resolve the hostname at the collector, or not at all. Am I missing something simple here, or is this not possible with 2.0.7?
This is not possible right now. -- Bazsi
Bazsi wrote:
On Jan 20, 2008 1:08 PM, Steve Bernacki <syslogng@f.copacetic.net> wrote:
with the various dns_* options to no avail, as it seems like syslog-ng wants to either resolve the hostname at the collector, or not at all. Am I missing something simple here, or is this not possible with 2.0.7?
This is not possible right now.
We are using "spoof-source" to accomplish this end result, of course this only works for UDP. I'd recommend having a post-processing script do the IP->DNS translation after syslog-ng has done it's part. Kevin
participants (3)
-
Balazs Scheidler
-
K K
-
Steve Bernacki