[syslog-ng] DOMAIN Name Variable

[Valdis.Kletnieks at vt.edu]

On Tue, 14 Mar 2006 09:04:13 GMT, David Anderson said:
> Rob,
> 
> Monday, March 13, 2006, 11:47:52 PM, you wrote:
> 
> > that would be the TLD, yes:  but i got the impression jason means 
> > 'domain' more like
> > xyz.com
> > foo.edu
> > how.de
> 
> > so therefore 'starting with the string before the last dot.'
> 
> That doesn't work, as many domains outside of the US have a 3-part
> domain, as in xyz.co.uk.

And even within the US, the number of levels in the domain are quite flexible.
For instance, most of our hosts are of the form 'hostname.dept.vt.edu' - but in
a few cases, we have only 3 levels (mostly central servers), and in others we
have 5 levels - the CS department has a few hosts of the form
'hostname.project.cs.vt.edu' for some large long-term groups.

The only sane definition is "everything between the *first* period and
the *final* period" (yes, there's a (usually implicit) trailing period in 
there, and some DNS resolvers would consider that 'foo.cc.' was a domain under
the 'cc' top-level domain, and 'foo.cc' was 'foo.cc.vt.edu'.  And forgetting
the trailing dot is a favorite way to hose up an entry in a BIND zone file. ;)

echo ${FQDN} | cut -d. -f2-

is what you want.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20060314/37715ca0/attachment.pgp