syslog-ng 系列连载-35 ：在 syslog-ng 中使用 DNS

6.2. Using name resolution in syslog-ng

The syslog-ng application can resolve the hostnames of the clients and include them in the log messages. However, the performance of syslog-ng is severely degraded if the domain name server is unaccessible or slow. Therefore, it is not recommended to resolve hostnames in syslog-ng. If you must use name resolution from syslog-ng, consider the following:

# 注释 ：你可以让 syslog-ng 解释日志消息中的客户机机的名称。但是 syslog-ng 的性能会严重受到影响（如果 DNS 服务器无法访问的话）。

# 所以不建议在 syslog-ng 中使用主机名解释。如果你一定要这么做，按照下面的步骤 ：

#     -）1、使用 DNS 缓存。默认 syslog-ng 缓存 1007 个主机名。你可以用 dns_cache（N） 来修改

#     -）2、如果额客户机的地址很少变动，可以延长 dns 缓存的有效期，这是通过 dns_cache_expire 选项实现的。单位是秒

#     -）3、如果有可能，在本地实现 DNS 解释

• Use DNS caching. Verify that the DNS cache is large enough to store all important hostnames. (By default, the syslog-ng DNS cache stores 1007 entries.)

  options { dns_cache(2000); };
                  

• If the IP addresses of the clients change only rarely, set the expiry of the DNS cache large.

  options { dns_cache_expire(87600); };
                  

• If possible, resolve the hostnames locally. See for details.

	Note
	Domain name resolution is important mainly in relay and server mode.

6.2.1. Resolving hostnames locally

Resolving hostnames locally enables you to display hostnames in the log files for frequently used hosts, without having to rely on a DNS server. The known IP address – hostname pairs are stored locally in a file. In the log messages, syslog-ng will replace the IP addresses of known hosts with their hostnames. To configure local name resolution, complete the following steps:

# 注释 ：本地解释允许你在日志文件中显示经常使用的主机名，而不用通过 DNS 查询。实际上就是通过类似 /etc/hosts 文件的格式，不过你可以另外指定其他文件

#     -）1、首先往指定的文件中添加主机名和 ip 地址。在 linux 下，一般是 /etc/hosts 文件。

#     -）2、告诉 syslog-ng 只解释本地主机名。这是通过 use_dns（persist_only）实现的。

#     -）3、再通过 dns_cache_hosts（/etc/hosts）指定存储永久主机名信息的文件

Procedure 6.1. Resolving hostnames locally

1. Add the hostnames and the respective IP addresses to the file used for local name resolution. On Linux and UNIX systems, this is the /etc/hosts file. Consult the documentation of your operating system for details.

2. Instruct syslog-ng to resolve hostnames locally. Set the use_dns() option of syslog-ng to persist_only.

3. Set the dns_cache_hosts() option to point to the file storing the hostnames.

   options { 
           use_dns(persist_only);
           dns_cache_hosts(/etc/hosts); };   
   

---