Archive
Highlighted

connection_host = dns not working

Communicator

Hi,

I set new sourcetype: syslog-net for syslog events I don't want to extract host from.
My settings:

inputs.conf
[udp://55555]
connection_host = dns
disabled = 0
index = net
sourcetype = syslog-net

props.conf
[syslog-net]
MAXTIMESTAMPLOOKAHEAD = 32
REPORT-syslog = syslog-extractions
SHOULDLINEMERGE = False
TIME
FORMAT = %b %d %H:%M:%S
category = Operating System
maxDist = 3
pulldown_type = true
TRANSFORMS =

Problem is that it sometimes (for some IP address) doesn't work. I see reverse dns requests to DNS server, but even if there are responses, I see some IP not resolved (10.26.x.y instead of resolved host name).

Do you have any ideas?

Tags (1)
0 Karma
Highlighted

Re: connection_host = dns not working

Explorer

I have only one idea. Your sourcetype from props.conf overwrite resolved host field. You can read about it input.conf example:

* If the input is configured with a 'sourcetype' that has a transform that   overrides the 'host' field e.g. 'sourcetype=syslog', that will take precedence over the host specified here.
0 Karma