I used to only log by IP and was fine with it. But with a recent acquistion and to make things easier, I turned on the use of DNS by Syslog-NG. However, it doesn't appear to resolve every source host. For example, I am sending syslogs from about 50 sets of Cisco PIX firewalls, 5 VPN Concentrators and 2 Cisco Cache Engines. Only about 80% of the PIX firewalls are being resolved when they show up in the syslog file, 2 of the concentrators and none of the cache engines. I have verified that all of the firewalls are in DNS and PINGable from the syslog server itself. I'm not sure what else to check. I saw an old post from September 2003, but I don't think it's the same issue. This appears to be a consistent problem, some hosts are always resolved and some are not. Below are the options that are set in my syslog-ng.conf file. options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); dns_cache(yes); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port (514)); }; Let me know if any other info would be benenficial. Thanks, Chris Sawall, GSEC, GSNA Ameren Information Security ******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************
I had this same problem. I resolved it by logging by IP and then doing reverse DNS lookups with a script and creating symbolic links to those IP based directories. The end result was people who like to use IP or DNS were happy. Gotta make sure your reverse is set up properly though. But I never did find out why syslog-ng couldn't resolve the same names that the host command on the same box could. Sawall, Christopher L wrote:
I used to only log by IP and was fine with it. But with a recent acquistion and to make things easier, I turned on the use of DNS by Syslog-NG. However, it doesn't appear to resolve every source host.
For example, I am sending syslogs from about 50 sets of Cisco PIX firewalls, 5 VPN Concentrators and 2 Cisco Cache Engines. Only about 80% of the PIX firewalls are being resolved when they show up in the syslog file, 2 of the concentrators and none of the cache engines. I have verified that all of the firewalls are in DNS and PINGable from the syslog server itself.
I'm not sure what else to check. I saw an old post from September 2003, but I don't think it's the same issue. This appears to be a consistent problem, some hosts are always resolved and some are not.
Below are the options that are set in my syslog-ng.conf file.
options { sync (1); time_reopen (10); log_fifo_size (2048); long_hostnames (off); dns_cache(yes); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port (514)); };
Let me know if any other info would be benenficial.
Thanks, Chris Sawall, GSEC, GSNA Ameren Information Security
******************************* The information contained in this message may be privileged and/or confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. Note that any views or opinions presented in this message are solely those of the author and do not necessarily represent those of Ameren. All emails are subject to monitoring and archival. Finally, the recipient should check this message and any attachments for the presence of viruses. Ameren accepts no liability for any damage caused by any virus transmitted by this email. If you have received this in error, please notify the sender immediately by replying to the message and deleting the material from any computer. Ameren Corporation *******************************
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- .Jarrod Manzer. .Network Team. .Go Daddy Group. .(480) 366 3631. .AIM: nejarrod.
On Wed, 01 Jun 2005 09:33:58 PDT, Jarrod Manzer said:
I had this same problem. I resolved it by logging by IP and then doing reverse DNS lookups with a script and creating symbolic links to those IP based directories. The end result was people who like to use IP or DNS were happy. Gotta make sure your reverse is set up properly though.
But I never did find out why syslog-ng couldn't resolve the same names that the host command on the same box could.
The most common cause for things like this is semi-borked DNS that *appears* to work, but in fact is subtly misconfigured. A few things to check: 1) Take the IP address, and look up the PTR, which should give you a hostname (this is where most 'host' commands stop). Then actually check that hostname in the DNS, and make sure the IP is listed in an A record (some resolvers do this additional sanity checking). 2) You may have a "lame delegation". Look at the SOA and NS entries for your DNS zones, both PTR and A, and double-check that all machines listed in NS are in fact serving up correct data for the zones (a quick double-check is if all the DNS servers show the correct zone serial number in the SOA). It often happens that if there are multiple NS records, a daemon will "lock in" on asking one NS first, and if it returns an authoritative NXDOMAIN because it's a lame delegation, the daemon won't ask other NS. However, when you use the 'host' command, it may check some *other* NS entry first and magically appear to work. 3) Double-check /etc/resolv.conf to make sure it points 'nameserver' entries at DNS servers that pass the sanity checks in (1) and (2)....
participants (3)
-
Jarrod Manzer
-
Sawall, Christopher L
-
Valdis.Kletnieks＠vt.edu