On Mar 21, 2007, at 1:00 PM, Dan Shoop wrote: At 10:30 AM -0400 3/21/07, Chris Waltham wrote: On Mar 20, 2007, at 3:00 PM, Dan Shoop wrote:
Concerning your problem with seeing IPs in the syslog, it sort of sounds like you may not have a reverse DNS map. Many of the times I see people build the forward map, but forget (or don't fully understand the need for) the reverse map. Can you confirm that you have the reverse map? You can go to your OSX server and execute 'dig -x IPADDR' to verify that the map is there and can resolve back to a hostname. The only other option you have is to maintain a copy of the hosts in the hosts file. That should also allow syslog to resolve the hostnames correctly.
I'm 99% sure I had reverse lookups functioning correctly at the time, but I'll have another look. I'm pretty sure I tried the /etc/hosts trick too... :-\
More importantly make sure your OS X Servers have this properly configured by using the following command:
# changeip -checkhostname
Many, many ppl seem to "think" they have this configured correctly and don't, ever w proper PTRs.
I neglected to mention that it's actually a regular version of OS X running splunk, not OS X Server. But even still; I double-checked and both forwards and reverses exist for the machine that splunk runs on and the target machine I'm trying to garner logs from. But, thanks for the suggestion!
The above only applies to OS X Server.
Note this is an OS X Server list ;)
I know, I was hoping I could fly in under the RADAR :-) In the case of of OS X it doesn't care too much.
Just for giggles, I may try it under OS X Server and see what happens. But I doubt I will notice a change...
Chris
|
