1
answer

Hi everybody,

stumbled over a problem that sometimes I get hostnames from nxlog other times it's fqdns. Happens only with internal nxlog messages.I tired to fix this by using the Exec $Hostname = hostname_fqdn(); statement.

# Nxlog internal logs
<Input internal>
   Module im_internal
   Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
   Exec $Hostname = hostname_fqdn(); 
</Input>

Still get messages with designation nxlog: internal that have a source_host with hostname only and not fqdn.

Either I am missing something really obvious or something is broken. Any guidance to troubleshoot or figure out what is going on much appreciated

Best regards

Tobias

AskedJanuary 6, 2017 - 5:36pm

Answer (1)

> sometimes I get hostnames

I assume "sometimes" means on one host you get fqdn and on another the short form?

You didn't tell what the OS is but in any case NXLog only returns the value that it gets from the OS. You will need to properly configure the hostname of your system.

AnsweredJanuary 8, 2017 - 4:12pm

Comments (8)

  • tobias42's picture

    the meaning of "sometimes" was that messages from the windows event log send by nxlog to logstash are porperly formated (fqdn).
    messages from nxlog internal arrive with hostname only, fix bellow "Exec $Hostname = hostname_fqdn();" doesn't work. Windows ipconfig -all
    reports correct fqdn so does the powershell $myFQDN=(Get-WmiObject win32_computersystem).DNSHostName+"."+(Get-WmiObject win32_computersystem).Domain
     

    # Nxlog internal logs
    <Input internal>
       Module im_internal
       Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
       Exec $Hostname = hostname_fqdn(); 
    </Input>

     so not sure where the wheels fall off but to me it looks that the system has correct FQDN

     

    January 10, 2017 - 10:27am
  • b0ti's picture

    Ok, so to make the long story short, your problem is that hostname_fqdn() returns the short form and not the fqdn. Is that correct?

    NXLog uses the gethostname() function internally for this and its documentation says:

    "If no namespace provider responds, then the gethostname function returns the NetBIOS name of the local computer"

    Can you check what you have for your NetBIOS name?

     

    January 10, 2017 - 11:22am
  • sa's picture

    Can you try this snippet? Note the order of the hostname_fqdn and to_json  functions.

    <Input int>
        Module im_internal
        Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; $Hostname=hostname_fqdn(); to_json();
    </Input>

     

    January 10, 2017 - 3:57pm
  • tobias42's picture

    Hi sa, thanks for the suggestion, it works on windows server 2008 R2 and windows server 2012 R2 for some reason it does not on windows server 2016 :-(
    can you elaborate on why the different format? In a previous response from B0ti it was stated that internally nx-log uses gethostname() function which does only
    return the hostname, so unless there is additional code around the gethostname() function call that gathers the domain and puts <hostname>.<dns domain> 
    together I am struggling how it works with the recommended format...

     

     

    January 11, 2017 - 12:40pm
  • b0ti's picture

    In your original conf you have this:

       Exec $EventReceivedTime = integer($EventReceivedTime) / 1000000; to_json();
       Exec $Hostname = hostname_fqdn(); 

    Since to_json() is called earlier, $Hostname would have the value of hostname(), not hostname_fqdn() like you intended.

    The fqdn hostname is determined by NXLog using the gethostname() POSIX function call. If there is no dot in the returned value it tries to look up the IP address for that name and then resolves the IP back into a FQDN via DNS.

    gethostname() is platform independent and there was no reason to use the GetComputerNameEx() thats available under Windows only. We could still resort to using that if that deems necessary.

     

    January 11, 2017 - 12:50pm
  • tobias42's picture

    thanks b0ti for the clarification - as stated the version with both exec command before to_json works on my servers all but windows server 2016
    any ideas how to debug what is going on or potential ideas on what could go wrong there. 

    I did verify that DNS config on all servers is the same inclduing DNS suffix, DNS servers etc. 

     

    January 12, 2017 - 10:13am
  • sa's picture

    Unfortunately we couldn't reproduce this problem: a vanilla Windows 2016 server (build 14393.447) works fine with both the Enterprise and the Community edition of NXLog. I suggest you create a new Windows 2016 vm on an isolated subnet and gradually alter its config to match the state of your production servers.

    January 13, 2017 - 1:38pm