[rsyslog-notify] Forum Thread: Re: Maximum length of a resolved hostname? - (Mode 'reply')

[noreply at adiscon.com]

User: mc-sim 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25457#p25457

Message: 
----------
[b:2282whkg]dlang[/b:2282whkg], thanks for you help.

[quote="dlang":2282whkg]There is a max length for a hostname, but it's
pretty large (255 characters IIRC)

If you are limited to the official packages provided by SLES, then you
should be contacting them for support. We will help where we can, but as
Rainer says, 5.x is very old, so it may not have the same limits.
[/quote:2282whkg]
Of cource, I understand that. But I think that I will find solution in
MonitorWare-forum  )

[quote="dlang":2282whkg]
However, in this case, I'll bet that what's happening is that your DNS
server is not always responding fast enough, and when it doesn't respond
fast enough, rsyslog records the IP instead. This indicates that the
sending system is not following the RFCs in that it's not putting the
hostname or IP in the log message itself before it sends it.

One of the things added in newer versions is a DNS cache so that you aren't
hammering DNS and waiting for it to reply (or timeout)

putting entries for these systems in /etc/hosts will help
significantly.[/quote:2282whkg]

At the first time, I think the same as you... 
Also, I tried to make [i:2282whkg]nslookup something[/i:2282whkg]
or[i:2282whkg] host something[/i:2282whkg], then I may getting the big time
of response or timeout.
Then I installed nscd (name service cache daemon).
I watch the statistics аfter some hours of work. Statistics show, that
negative responses are minimal. 
Also, I tried to add some hosts (2-5 hosts) to /etc/hosts, but problem is
still.
After that I can make the conclusion: problem is not in DNS.

Important feature: there are problem only with ASA-devices and hosts with
big hostnames (for example p25-fw-5585-e01-e02-srv4-sc-1.scada.aaa.bbb.).

After holidays I will try to analyze UDP packets from correct devices and
problem devices. And test messages with different length of the hostnames.