[syslog-ng]dns caching

[Michael Renner]

At 12:16 09.07.2002 +0200, you wrote:

>i've been using syslog-ng for a while, and now that i've setup dnscache
>(from djb) to use syslog instead of his own loggin method (multilog), i've
>found a funny thing that fulls my log files. (dnscache pc and syslog-ng
>hosting pc are different machines, i log through network).
>
>1- when a dnscache-request is made, dnscache issues a message to syslog-ng.
>2- syslog-ng writes down to the syslog file the new entry, but it does a dns
>lookup (because the log entry is coming from a machine on the network).
>3- loop forever :)
>
>i don't want to use the use_dns(off) option of syslog-ng, because i wan't
>ips translated. Is there a way that syslog-ng could cache the dns querys, so
>id doesn't do one dns lookup for each line?

This was discussed previously on this list; dns caching shouldn't be the 
job of syslog-ng and would need much "unnecessary" code in syslog-ng; there 
are other programs which are more capable of doing this (dnscache from 
djb). I would suggest that you stick with multilog because dnscache is 
quite verbose and logging these rather unnecessary messages via syslog-ng 
would waste lots of cpu cycles (you don't log your apache access-logs via 
syslog, do you?)



mfg/best regards

-- 

Inode Telekommunikationsdienstleistungs GmbH  -  http://www.inode.at/
Michael Renner - Junior System Engineer
m.renner@inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599

Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien
Buero Graz - Schmiedlstrasse 1 - A-8042 Graz
Buero Sbg  - Schillerstrasse 30  - A-5020 Salzburg
Buero Ibk  - Eduard Bodem Gasse 5-7  - A-6020 Innsbruck