[syslog-ng] "Error resolving hostname" for UDP Destination

David Hauck davidh at netacquire.com
Fri Jun 12 19:09:03 CEST 2015


I've experienced problems starting syslog-ng related to hostname lookup on UDP destinations for a while now and am finally getting back to looking into some kind of mitigation for the exceptions. Here's what I see: if I have a destination configured with an endpoint that requires name lookup and the name lookup fails, I see the following error when attempting to start (or reload) syslog-ng:

Starting syslog-ng: Error resolving hostname; host='test.nacc.netacquire.dom'
Error initializing message pipeline;

Unfortunately, this results in the entire process failing to start.

If syslog-ng is otherwise running and I attempt to reload the configuration (with the problematic name present) I don't see any errors logged, but I do see that the process is now defunct (and is no longer running):

root     18674     1  0 10:03 ?        00:00:00 supervising syslog-ng
root     18701 18674  0 10:04 ?        00:00:00 [syslog-ng] <defunct> 

Here's the simple destination in question:

destination d_NAaudit_Prio { file("/var/log/netacquire/audit_log" template(t_NAFormat_Prio)); udp("test.nacc.netacquire.dom" port(514) template(t_NAFormat_Prio)); };

I'm wondering if there might be some way to mitigate this exception. For example:

1. Log the error and allow syslog-ng to otherwise continue to start/function without the destination being configured/used.
2. As above, and suspend the destination but allow it to continue to attempt to probe the name lookup so that if the resolution does eventually succeed the destination can be resumed.

Are either of the above options feasible/available? Are there any other ideas for how to mitigate this exception so that syslog-ng can be started/reloaded successfully (other than detecting this event a priori and removing the destination from the configuration before attempts to start/reload)?

Thanks in advance!

PS: Here's my version information:
# syslog-ng --version
Revision: ssh+git://algernon@git.balabit/var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#4090ee62163780ae68a0c83cfdc23998c904fe97
Compile-Date: May 19 2015 17:04:36
Available-Modules: confgen,afstomp,afmongodb,linux-kmsg-format,cryptofuncs,afsocket,csvparser,dbparser,afamqp,afsocket-tls,syslogformat,afsocket-notls,afprog,basicfuncs,afuser,affile,system-source
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: on
Enable-Linux-Caps: off
Enable-Pcre: on

More information about the syslog-ng mailing list