defining loghost in Solaris 10

[Shrp]

I have two different Solaris 10 machines that insist on resolving 'loghost' to be the local host. I have an entry in /etc/hosts defining loghost:

% grep loghost /etc/hosts
128.175.74.183 hermes hermes.cms.udel.edu loghost

...and I have even had nothing but 'files' for resolution in my /etc/nsswitch.conf, but a ping/ssh and syslogd all apparently ignore /etc/hosts and resolve 'loghost' to be the local host. Thanks!

 

[daFranze]

does loghost realy point to the remote machine?
run 'ping -s loghost' and check the IP!

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[Shrp]

Yes, the IP displayed by a ping -s loghost is that same machine - also tested with an ssh user@loghost - thanks!

 

[daFranze]

hmm, I suggest to add a line

local0.info     (TAB)        @[i]remotehostname[/i]

and a

local0.info     (TAB)        [i]/my/file/name[/i]

tocuh the file and do not forget to kill -HUP both syslog daemons

send a message to syslog daemon (both local and from the nont working remote host

logger -p local0.info huhu

do you get the messages?

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[Shrp]

I've had a similar situation set up before. A 'mail.crit' line that attempted to write to @loghost, but nothing gets written to the remote host.

I'm not clear what you mean by "remotehostname" in this case - if I hard code a remote host name (by real name) that works fine from syslog. I'm just concerned that 'loghost' isn't being resolved correctly, and wonder what other "surprises" are in store. If you meant to put "@loghost" in syslog.conf, then I've tried that and it doesn't work.

Thanks!

 

[daFranze]

ok, we can take a look at, what syslogd is doing with the requests, but nowadays this is not that easy, since svc takes care of the daemons, we need to remove syslog from svc's list and stop it, next start it with debug options...

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[daFranze]

ups, yes, you answered the question @remotehostname yourself, I suggest to set someting like @elvis if elvis is your loghost. If @elvis works and @loghost does not work it is a name resolve problem. Guessing it's a bug not a feature...

Best Regards, Franz
--
Solaris System Manager from Munich, Germany
I used to work for Sun Microsystems Support (EMEA) for 5 years

 

[Shrp]

I had already tried removing syslogd from svc and starting it in debug mode:

apollo:/# /usr/sbin/syslogd -d
main(1): Started at time Mon May 16 10:49:20 2005
hnc_init(1): hostname cache configured 128 entry ttl:600
getnets(1): network is being turned off
amiloghost(1): testing 128.175.74.10.2.2
conf_init(1): I am loghost
...

Doing the "@elvis" does work - doing "@loghost" goes to itself. Unless the syslog configuration affects how the name is resolved, I'm certain it's some bug in name resolution, yes. Thanks!