SYSLOG: Warning Loghost Could Not be Resolved

At reboot, the following error message is seen on the console and also in
/var/adm/messages:

	SYSLOG: Warning loghost could not be resolved

This message means that syslogd cannot resolve the hostname for the
loghost.

There are several possible reasons for this.

Problem 1) The hosts line in /etc/nsswitch.conf
Problem 2) syslog is commented out of /etc/services
Problem 3) A comment (#) in front of the word loghost in /etc/hosts



Problem 1) The hosts line in /etc/nsswitch.conf

Solution 1) To see what hostname "loghost" is being resolved as use the
command:

	# getent hosts loghost

If this command does not return the hostname of the expected loghost and
just returns the prompt with no data, this indicates that the hostname
cannot be resolved.

Here is the output if it is able to resolve which hostname is defined as
loghost:

	# getent hosts loghost
	129.147.45.104  zotz loghost


By default, the format of the hosts line in the /etc/nsswitch.
files is 

	hosts:       [NOTFOUND=return] files

This line means that the name service will be queried first and if the
hostname for loghost is not found, it will stop looking.  
The local /etc/hosts file will not be queried at all for the hostname.

To solve, check the hosts line in /etc/nsswitch.conf and verify that the
word files is in the line for hosts.

Note: It is preferable to have files first, however it can also work as in
the second example.

Examples:

	hosts:      files nis dns
	
	hosts:      nis files dns

In this way, the entry for loghost will be found locally in /etc/hosts
after querying the nameservice (and failing to find the hostname for
loghost in the nameservice maps).

Note: the steps above do not apply if loghost is defined in a name
service map rather than locally in /etc/hosts.




Problem 2) syslog is commented out of /etc/services

Example:
# syslog          514/udp

Solution 2) Enable syslog by removing comment from the beginning of the
line.

Example:
syslog          514/udp

After editing /etc/services, it may be necessary to kill and restart inetd:
# ps -ef | grep syslog

# kill -9 

# /usr/sbin/inetd -s -t


or reboot the system. 




Problem 3) A comment (#) in front of the word loghost in /etc/hosts
	127.0.0.1	localhost
	129.147.44.10   persia # bad comment line loghost
	129.148.11.21   ib-sf4800-admin

This poorly placed comment line causes the work loghost to be seen as part
of the comment.

Solution 3) Move the word 'loghost' in front of the comment sign (#) in
order for it to
be read.

	129.147.44.10   persia loghost  # better comment line