[syslog-ng]syslog-ng stopped working yesterday

[Carson Gaspar]

--On Thursday, December 30, 2004 6:36 PM +0100 Balazs Scheidler 
<bazsi@balabit.hu> wrote:

> you can always disable resolving names from DNS, but what else could you
> do? if I'd do non-blocking DNS queries and would continue processing on
> other messages while waiting for a given message to resolve, then
> message ordering will be bad.
>
> An other solution might be to add non-DNS name lookups, e.g. resolve
> names from a private mechanism to make it possible to use names in
> messages and use IP addresses if it fails, but never block.
>
> What do you think about this solution?

I'd suggest using an async DNS lookup with configurable timeout. This 
allows you to have multiple DNS queries in-flight at once (assuming you're 
willing to buffer, but syslog-ng does that already, at least on output). 
e.g.:

recv line 1
start line 1 lookup
recv line 2
start line 2 lookup
get line 2 answer
...
line 1 lookup times out
write line 1 (with IP address)
write line 2 (with FQDN)

This allows me to have names where possible, but tweak the timeout for my 
DNS setup (I may decide that if it doesn't resolve in 1 second, it isn't 
going to)

-- 
Carson