Hello to All!

I have an issue using the nxlog agent community edition.
My output part of the config file looks like this:

Module om_udp
Host graylog.domain.local
Port 12201
OutputType GELF

As failover mechanism I use the DNS record for graylog.domain.local.
When the primary graylog node is unreachable, the DNS record is updated to the secondary node.

For some log sources, the OS is picking up the change almost immediately (there is no cache enable) but the agent doesn't deliver logs to the secondary node until the nxlog service is restarted.

Couple of questions:
1. Does the nxlog service keep any DNS cache?
2. If yes, is there any way to bypass it?
3. Any advice on how to fix the issue?

Many thanks in advance

AskedJuly 22, 2020 - 12:47pm

Answer (1)

There is a xm_resolver module in Enterprise version that could help with that issue. The only idea for CE version is to use xm_exec in order to get that value from the OS.

Comments (1)

  • tato's picture

    Hi Manuel,

    Many thanks for your answer.

    Unfortunately, i don't think this can address my issue.
    The xm_resolver or xm_exec cannot change the host parameter DNS resolution in the output section.

    What i'm trying to achieve here is:
    The DNS record for the host will change.
    Nxlog agent should pick up the change and output to the new IP without service restart.

    Anyway thank you for the information, both modules are quite interesting to address other scenarios i will face later down the road :)