[syslog-ng]$HOST gives IP address instead of hostname

[_/CaT\_]

HI *,
I have to get events from _Enterasys_ machines and I need to resolve IP
address with /etc/hosts.
When I set on Keep_hostname() I receive logs bad formatted, an example:

Before:
2002 Aug 22 10:42:20 10.1.163.3 local7.err unknown or ambiguous facility
\'e\'

After:
2002 Aug 22 10:42:20 %CLI-E-FACUNKNWN, local7.err unknown or ambiguous
facility \'e\'

And more when I try to set Gethostname() on or yes ,in the configuration
file I received an error.:

 ..

The active options are:
options {
  long_hostnames(off);keep_hostname(no);sync(0);stats(3600);use_dns(no);
#  gethostbyname(yes);
 
use_fqdn(no);dns_cache(no);log_fifo_size(1000);gc_idle_threshold(100);gc
_busy_threshold(3000);};


This is a new bug or a mistake of mine ?
Thanks
_/CaT\_

-----Original Message-----
From: syslog-ng-admin@lists.balabit.hu
[mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of William Yodlowsky
Sent: Wednesday, August 21, 2002 3:16 PM
To: syslog-ng@lists.balabit.hu
Subject: Re: [syslog-ng]$HOST gives IP address instead of hostname


Balazs Scheidler <bazsi@balabit.hu> wrote:

> On Wed, Aug 14, 2002 at 05:08:11PM -0400, William Yodlowsky wrote:
> > William Yodlowsky <wyodlows@andromeda.rutgers.edu> wrote:
> > 
> > > Hello,
> > >
> > > I have syslog-ng configured with create_dirs(yes) and $HOST in 
> > > several
> > > places, and I find that occasionally during a restart (HUP or 
> > > stop/start) it will create some directories with the IP address of
the
> > > machine instead of the resolved hostname.  I have these options in
use:
> > >
> > > options { long_hostnames(off); keep_hostname(yes); use_dns(no); };
> > >
> > > All systems that are sending logs to this machine have an entry in

> > > the /etc/hosts file locally, yet some end up with a logfile with 
> > > this in it:
> > >
> > > Aug 12 11:51:11 a.b.c.d syslog-ng version 1.5.13 going down Aug 12

> > > 11:51:11 a.b.c.d syslog-ng version 1.5.13 starting Aug 12 17:29:00

> > > a.b.c.d syslog-ng version 1.5.13 going down Aug 12 17:29:03 
> > > a.b.c.d syslog-ng version 1.5.13 starting
> > >
> > > a.b.c.d is in private address space.
> > >
> > > I should note that this happened with 1.5.10 as well.
>
> if use_dns() is set to no, syslog-ng will _never_ resolve hostnames, 
> not even from /etc/hosts. (as gethostbyname() immediately goes to DNS 
> if not found in /etc/hosts)
>
> The reason you have hostnames in your files is that you have 
> keep_hostname() set to yes, which makes syslog-ng to accept any 
> hostname it receives. If hostname was not specified by the sender, 
> syslog-ng inserts one on its own, and as use_dns is off, it inserts an

> IP address.
>
> If you are sure syslog-ng may not receive messages from hosts that are

> not resolvable, simply turn use_dns() on. This will make syslog-ng to 
> resolve those IPs.
>
> Note that syslog-ng blocks on DNS queries, thus it might be an easy 
> DoS.

Wonderfully simple answer.  Thanks very much!


_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html