[syslog-ng] DNS Cache with /etc/hosts

[Balazs Scheidler]

On Thu, 2008-05-15 at 09:27 +0100, Hari Sekhon wrote:
> Andrew Kerr wrote:
> > I have the following set:
> > use_dns(persist_only);
> > dns_cache(yes);
> > dns_cache_hosts(/etc/hosts);
> >
> > After I make a change to /etc/hosts, how long until syslog-ng will pick up
> > the change?
> >
> >
> > ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.campin.net/syslog-ng/faq.html
> >
> >
> >   
>  From the administrator's manual:
> 
> dns_cache_expire() 	number 	3600 	Number of seconds while a successful 
> lookup is cached.
> 
> 
> so you will either have to wait that many seconds (3600) by default or 
> it will be instantaneous, depending on the behaviour of syslog-ng.
> 
> So the question now becomes
> 
> Does the /etc/hosts file bypass the cache the same way that the os does 
> and make the change instantaneous?

any change to the /etc/hosts file triggers a reload into syslog-ng's
cache. so yes, it is instantanous.

> 
> On linux for example any change made to the /etc/hosts file results in 
> instant redirection to the new lookup result even when a name cache 
> daemon is running, I would expect syslog-ng to do the same in some ways, 
> although I wouldn't be surprised if it didn't for performance reasons...
> 
> The line below from the administrator's manual implies that it would be 
> instantaneous since if it bypasses dns then surely it doesn't use the 
> dns_cache?
> 
> "Name of a file in |/etc/hosts| format that contains static IP->hostname 
> mappings. Use this option to resolve hostnames locally without using a DNS."
> 
> -h
> 
-- 
Bazsi