[syslog-ng]BUG: Number in Hostnames?

[Jonathan Marchand]

Balazs,

On both hosts the DNS lookup and reverse lookup are working fine:

Name:   nexus1.webnet.qc.ca
Address: 209.71.224.10

And reverse:

10.224.71.209.in-addr.arpa      name = nexus1.webnet.qc.ca.

Also, I added the line:

209.71.224.10           nexus1.webnet.qc.ca nexus1

to /etc/hosts on both hosts.

I did try to sniff the traffic using tcpdump, I used "sniff" to translate
the output from hex to ascii. However, the messages were fine but the
hostname was not translated properly, it was still hex codes. You know a
tool I could use to reliably sniff and translate syslog traffic?

Thanks,

Jonathan.

>
> ----- Original Message -----
> From: "Balazs Scheidler" <bazsi@balabit.hu>
> To: <syslog-ng@lists.balabit.hu>
> Sent: Monday, June 17, 2002 1:02 PM
> Subject: Re: [syslog-ng]BUG: Number in Hostnames?
>
>
> > On Mon, Jun 17, 2002 at 12:05:07PM -0400, Jonathan wrote:
> > > Hi,
> > >
> > > I've been toying a bit with syslog-ng, I'm quite happy so far with all
> the
> > > possibilities it offer me. But I got a problem getting it to work in
my
> > > environment.
> > >
> > > I want to log normal syslogd machines to a LogHost which would run
> > > syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few
> > > tests.
> > >
> > > With this config:
> > >
> > > options { sync (0);
> > >           time_reopen (10);
> > >           log_fifo_size (1000);
> > >           long_hostnames (no);
> > >           chain_hostnames (no);
> > >           use_dns (no);
> > >           use_fqdn (no);
> > >           create_dirs (no);
> > >           keep_hostname (yes);
> > >         };
> > >
> > > source s_sys { unix-stream ("/dev/log"); internal();
> > >         udp (ip(209.71.224.21) port (514)); };
> > > destination mail1 { file("/var/log/mail1"); };
> > > filter filter_mail1 { host("mail1");};
> > > log { source(s_sys); filter(filter_mail1); destination(mail1); };
> > >
> > > As you can see, I want to log a host named "mail1" to a file "mail1".
> > > However, it doesn't work. The host send its log entries syslog-ng but
> > > doesn't recognize "mail1".
> > >
> > > But, if I change the host("mail1") to host("mail"), it work perfectly.
> The
> > > hostname in the /var/log/mail1 file is "mail" tho, not "mail1".
> > >
> > > I ran syslogd into debug mode on my "mail1" machine. I saw it does
send
> the
> > > logs out with the "mail1" tag.
> > >
> > > I tried this with another of my host, its name is nexus1, I
experienced
> the
> > > same behavior.
> > >
> > > So, I'm wondering if syslog-ng doesn't like having a number at the end
> of
> > > the hostname.
> > >
> > > The hosts running syslogd are RedHat 7.2 and 7.1.
> > >
> > > Any ideas? :) I'd like to get this working, all my hostnames got
> numbers....
> >
> > hmm.. I don't care if hostnames contain numbers or not. Does reverse DNS
> of
> > those hosts contain the correct name (with the number ?)
> >
> > You could sniff your network interface to see if the hostname is really
> > present. (sometimes it is missing, and is added by syslog-ng based on
the
> > DNS name of the host)
> >
> > --
> > Bazsi
> > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C
> 8EB1
> >
> > _______________________________________________
> > syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> > https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> >
> >
>
>