Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently filtering logs to a CentOS 6.3 syslog-ng server. Below is my basic syslog-ng config.

options {

Most of the servers coming in are working correctly. I see However, there are a few that are not working correctly. One example is a Cisco switch. It is and continues to create a folder of I can do a nslookup of the IP on the syslog-ng box and it shows the correct domain name. I can also do a tcpdump for the domain name and it show up correctly. So I then tried adding the entry in /etc/hosts to force it to use the domain name and still haven't had any luck. It continues to come across as the IP address.

There is 1 more weird issue that I'm having with a few other servers. Sometimes the logs go into a /logs/computer_name folder and other times it goes into /logs/ folder. It seems to be confused on what the true DNS name is.

Anyone have any recommendations on what to try?

Thanks, Eric

share|improve this question
could you please post your nsswitch.conf? or are you using two dns servers and in one the reverse lookup of the ip isn't enabled or the IP isn't configured correctly there? – Hartmut Apr 26 '13 at 14:16
@Hartmut - My nssiwtch.conf has this line in it - "hosts: files dns". I am currently using 3 DNS servers. I confirmed that all of them are able to nslookup the IP correctly. – Eric Apr 26 '13 at 14:29
The keep_hostname(yes) keeps the name in the packages you receive from the cisco switch. Could it be that the cisco Switch just sends the IP in the package? I guess because of the keep_hostname option the lookup of the dns name is omitted and syslog-ng just thinks it already has the hostname, although it is just the IP. – Hartmut Apr 26 '13 at 19:07
@Hartmut - That appears to be exactly what is happening. I just thought I would be able to override that with the /etc/hosts file in the event that occurs. – Eric Apr 26 '13 at 19:28
I think then you need to deactivate the keep_hostname option. As far as I understood it, it overrides all the other names options. – Hartmut Apr 26 '13 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.