syslog server is not getting the source hostname

http://www.campin.net/syslog-ng/expanded-syslog-ng.conf

HOST               The name of the source host where the message
#                       is originated from. If the message traverses
#                       several hosts, and chain_hostnames() is on,
#                       the first one is used.

destination std {
        file ("/var/log/HOSTS/$YEAR-$MONTH/$HOST/$FACILITY-$YEAR-$MONTH-$DAY"
                owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)
        );
};


when i used $HOST i am getting IP address of the host and not the hostname

why?
linuxpersonAsked:
Who is Participating?
 
linuxpersonAuthor Commented:
it was a DNS issue. i fixed.
0
 
jmarkfoleyCommented:
Did you try $HOSTNAME instead of $HOST?
0
 
savoneCommented:
Does the machine have access to a DNS server to resolve the IP to a host (PTR) record?
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
gheistCommented:
If you resolve reverse DNS it will add 1/1000-15s delay before log message hits the disk. You can resolve IPs offline if you really need it later.
0
 
savoneCommented:
@gheist, if your DNS takes 15 seconds to answer you have more problems than syslog.

You can also add all the hostname to the host file on the syslog server if you do not want to send a bunch or queries to your DNS server.
0
 
gheistCommented:
DNS timeout to understand that there is no record is 5..45s depending on age of system. Like 90% of internet has no reverse delegation... Thats why suggestion to use best practice of not doing DNS lookups during log capture.
0
 
savoneCommented:
Wouldn't the best practice be to add the necessary DNS records?
0
 
linuxpersonAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for linuxperson's comment #a40689985
Assisted answer: 250 points for gheist's comment #a40677412
Assisted answer: 250 points for savone's comment #a40677851

for the following reason:

found solution myself
0
 
savoneCommented:
I have to object, I mentioned DNS issues several times. My first comment was questioning about DNS.
0
 
gheistCommented:
We both can be right in a good solution - no more inline lookup and DNS fixed - a clear win-win...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.