[syslog-ng] syslog uses wrong and weird hostnames

[Daniel Neubacher]

Hello there,
My syslog-ng is logging fine from 700 servers but a few times per day it is logging into a wrong folder which is created by the $HOST variable.
Normally syslog should use a hostname like host-1.worker.foobar.com but a few times a day it creates a folder names like:

4.22
p6-allrouter?
p6-localnet
p6-mc?
p6-mcastpref
p6-mcastpref?
host-1.worker.foobar.xcom
and other weird names...

It only logs one or two lines and then uses the right folder again. Does anyone have a clue where I have to look for the problem?

Here are the option line from the server and the client:

Client:
@version: 3.3
options {
    threaded(yes);

    use_dns(yes);
    use_fqdn(yes);
    dns_cache(yes);
    dns_cache_size(16384);
    dns_cache_expire(3600);
   dns_cache_expire_failed(10);

    log_msg_size(256000);
    log_fifo_size(100000);

    normalize_hostnames(yes);
    check_hostname(yes);
    bad_hostname("^gconfd$");

    create_dirs(yes);
    owner("root");
    group("root");
    perm(0640);

    time_reopen(30);
};

Server:

options {
    threaded(yes);
    owner("root");
    group("root");
    perm(0660);

    dir_owner("root");
    dir_group("root");
    dir_perm(0770);
    create_dirs(yes);

    chain_hostnames(no);
    normalize_hostnames(yes);
    check_hostname(yes);
    keep_hostname(no);

    use_fqdn(yes);
    dns_cache(yes);
    dns_cache_size(16384);
    dns_cache_expire(3600);
    dns_cache_expire_failed(60);

    log_msg_size(256000);
    log_fifo_size(1000000);
};

Destination example:
destination d_syslog { file("/log/syslog/${R_YEAR}/${R_MONTH}/${R_DAY}/$HOST/$PROGRAM"); };



--
Daniel Neubacher, Network Administrator
daniel.neubacher at xing.com<mailto:daniel.neubacher at xing.com>

XING AG
Gaensemarkt 43, 20354 Hamburg, Germany
Tel. +49 40 419131-28, Fax +49 40 419131-11

Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807
Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape
Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120924/12509807/attachment.htm