[syslog-ng]Unwanted logging

[Balazs Scheidler]

On Tue, Sep 17, 2002 at 02:31:46PM +0200, BENGT OLSSON wrote:
> Hi
> 
> I get some unwanted loggin from strange hosts....
> 
> The syslog-ng.conf-file looks like;
> 
> options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); 
> long_hostnames(off); sync(0); log_fifo_size(1000); };
> source all { sun-streams ("/dev/log" door("/etc/.syslog_door")); 
> internal(); udp();  };
> destination hosts { 
> file("/var/syslog/hosts/$HOST/$FACILITY_$YEAR-$MONTH-$DAY" owner(root) 
> group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };
> log { source(all) ;  destination(hosts) ; };
> 
> An example of unwanted "hosts"-directory in the /var/syslog/hosts-directory;
> 0x0.0x5da74da             
> 0x0.0x5dc3cea
> 0x0.0x5dc3d5a
> 0x0.0x5dc4077
> 0x0.0x5dca334
> 0x0.0x5dcea7a
> 0x0.0x637fb77
> 0x0.0x642bad8
> 0x0.0x64c5ea8

one of your devices send messages with bogus hostname part, and
keep_hostname() keeps those.

1) turn off keep_hostname()
2) stop those hosts sending hostnames like those above

> 
> An example of correct hosts -directory in the 
> /var/syslog/hosts-directory looks like this;
> trillian.student.bth.se
> trumma.bth.se
> viking.student.bth.se
> viola.bth.se
> violin.bth.se
> vogonjeltz.student.bth.se
> voyager.student.bth.se
> vroomfondel.student.bth.se
> zaphod.student.bth.se
> 
> Is there some internal logging or what is it comming from?
> 
> A minor problem is that i have  the "long_hostnames" to off and still it 
> loging whit long hostnames....any guess?

long_hostnames() is an alias to chain_hostnames()

try use_fqdn() instead.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1