with inputs.conf:connection_host=dns, events are being logged where host=[ip address]. Why

tvaniderstine — Wed, 16 Apr 2014 14:57:53 GMT

I'm running version 6.0.2 on CentOS 6. My DNS servers are a pair of Windows Server 2008 domain controllers. Every month, when I patch and reboot these Windows servers - which I do sequentially, Splunk writes logs to the database where host=[ip address] instead of host=[fqdn]. This breaks my alerting because my alerts are (mostly) defined by hostnames, for examplle:
host="DC*" AND "EventCode=4740"

While the logs are being written with host=[ip address], these alerts will never trigger.

Do I need to change the order of my dns servers listed in /etc/resolv.conf prior to rebooting my DNS servers? Or should I expect splunk to seamlessly send queries to the 2nd DNS to get a response?

Does splunk perform it's own DNS queries or does it rely on the underlying OS?
If it performs its own queries, is that configurable? Will changing the order of entries in /etc/resolv.conf require restarting Splunk?

I'd prefer to fix this wholly within Splunk, and without having to restart it monthly, because it takes 15 minutes to shut down.

Re: with inputs.conf:connection_host=dns, events are being logged where host=[ip address]. Why

rabbidroid — Sun, 08 Jun 2014 16:09:31 GMT

Similar Problem here, Version 5.0.1 on Solaris my HWF is refusing connections when the first DNS server listed in /etc/resolv.conf is not available.

I had to change the order of the DNS servers and restart nscd for it to recover.

It assume the reason is a timeout in DNS resolution, this should be able to be configured.

topic Re: with inputs.conf:connection_host=dns, events are being logged where host=[ip address]. Why in Getting Data In

with inputs.conf:connection_host=dns, events are being logged where host=[ip address]. Why

Re: with inputs.conf:connection_host=dns, events are being logged where host=[ip address]. Why