[syslog-ng] DNS Cache with /etc/hosts

[Hari Sekhon]

Andrew Kerr wrote:
> I have the following set:
> use_dns(persist_only);
> dns_cache(yes);
> dns_cache_hosts(/etc/hosts);
>
> After I make a change to /etc/hosts, how long until syslog-ng will pick up
> the change?
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>   
 From the administrator's manual:

dns_cache_expire() 	number 	3600 	Number of seconds while a successful 
lookup is cached.


so you will either have to wait that many seconds (3600) by default or 
it will be instantaneous, depending on the behaviour of syslog-ng.

So the question now becomes

Does the /etc/hosts file bypass the cache the same way that the os does 
and make the change instantaneous?

On linux for example any change made to the /etc/hosts file results in 
instant redirection to the new lookup result even when a name cache 
daemon is running, I would expect syslog-ng to do the same in some ways, 
although I wouldn't be surprised if it didn't for performance reasons...

The line below from the administrator's manual implies that it would be 
instantaneous since if it bypasses dns then surely it doesn't use the 
dns_cache?

"Name of a file in |/etc/hosts| format that contains static IP->hostname 
mappings. Use this option to resolve hostnames locally without using a DNS."

-h

-- 
Hari Sekhon