Nxlog agent DNS resolution cache | Log collection solutions

#1 tato 3 years ago

Hello to All!

I have an issue using the nxlog agent community edition. My output part of the config file looks like this:

Module      om_udp
Host        graylog.domain.local
Port        12201
OutputType  GELF

As failover mechanism I use the DNS record for graylog.domain.local. When the primary graylog node is unreachable, the DNS record is updated to the secondary node.

For some log sources, the OS is picking up the change almost immediately (there is no cache enable) but the agent doesn't deliver logs to the secondary node until the nxlog service is restarted.

Couple of questions:

Does the nxlog service keep any DNS cache?
If yes, is there any way to bypass it?
Any advice on how to fix the issue?

Many thanks in advance

Permalink

#2 manuel.munozDeactivated Nxlog ✓ 3 years ago

#1 tato

Hello to All! I have an issue using the nxlog agent community edition. My output part of the config file looks like this: Module om_udp Host graylog.domain.local Port 12201 OutputType GELF As failover mechanism I use the DNS record for graylog.domain.local. When the primary graylog node is unreachable, the DNS record is updated to the secondary node. For some log sources, the OS is picking up the change almost immediately (there is no cache enable) but the agent doesn't deliver logs to the secondary node until the nxlog service is restarted. Couple of questions: Does the nxlog service keep any DNS cache? If yes, is there any way to bypass it? Any advice on how to fix the issue? Many thanks in advance

There is a xm_resolver module in Enterprise version that could help with that issue. The only idea for CE version is to use xm_exec in order to get that value from the OS.