MonitorWare Knowledge Base

Hi all,

Is there a way to do a reverse lookup of the host with rsyslog, but only for dome IPs (or not to lookup for some IPs) ?

I have a setup with rsyslog collecting logs from firwalls (millions of events each day) and from exotic equipments that can't fill the HOST field with their hostname. So only their IP is displayed, which is annoying. The problem is that I can't modify the global behavior because of the firewalls (too much load on the server if I enable the DNS lookup). I would like to do reverse lookup only for the exotic equipments.

Is it possible ?

/Dangermax

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

I am sorry, that is currently not supported. However, a DNS cache is scheduled to be implemented in the not so distant future and that will probably solve your issue.

Rainer