how do I prevent syslogd from stripping domain names?

[Trever Furnish]

Running redhat7.2. My syslogd seems to be stripping off any domains from network hosts in the same domain as the redhat box when logging messages from those hosts, EVEN THOUGH -s is empty.

I've tried explicitely listing -s '' as an option - no luck.

I've tried explicitely listing -s with a bad domain like so: -s 'moomoo.cowcow' - no luck.

I've verified that if I add a fake entry to /etc/hosts for the ip address of the message source, then syslogd will leave the domain name alone *if* it doesn't have the same domain name as the domain reported on the end of the output of the 'hostname' command.

In other words, if the logging source is:
logger.foo.com

...and the logging receiver is:
logserver.foo.com

...then syslog strips foo.com, but if I go to logserver and execute:
hostname logserver

...thereby stripping the domain name, THEN syslogd happily records messages from logger as being from "logger.foo.com".

I need it to *always* record the FQDN. Anyone have a solution, other than chopping the domain out of the hostname?

I'll admit to a little confusion (and headache) regarding whether the domain name should even be there in the output of the hostname command normally, so any comments on that are welcome.

[Stuart Browne]

I don't suppose you've got a 'search ' in your /etc/resolv.conf ?

[Trever Furnish]

Yes, there's a search domain defined, but it doesn't seem to have an effect on this behavior - I took it out, restarted syslog, no joy.

[Stuart Browne]

*nod* thought it was a bit of straw grasping.

The Syslog documentation says that if the domain of the remote machine is the same as the domain of the local machine, it will strip all but the host-name (i.e. do a '-s local.domain.com').

But you've found this out already with your test of changing the local host name.

The documentation also states that there isn't a flag to say "don't strip".

Sorry.

You might want to grab the sources for syslogd, and manually remove the parsing routine that removes the domain, recompile, and use that.

[Trever Furnish]

Yeah, that was what I was afraid of. Well, not afraid, just avoiding.

I'm wondering though whether the domain name is even supposed to be in the output returned by the hostname command.

Ie if I do hostname now, just the unqualified hostname is returned - I'm not sure whether that is optimal or will cause a problem.

Sendmail uses an entirely different domain name and /etc/sysconfig/network still contains the FQDN. The man page for the hostname command isn't all that clear (at least not to me) on that point. Any thoughts?

[U.SivaKumar_2]

Hi,

remove 'domain' directive from /etc/resolv.conf
Restart syslogd .

regards,
U.SivaKumar

[Trever Furnish]

Um, I'm guessing you're refering to the search directive, and as I already mentioned I've verified that that doesn't help. Other thoughts?

[Donny Jekels]

Trevor,

Did you ever get to fix this issue?

You probibly forgot about this thread, but you should also look at your /etc/nsswitch.conf file to see where your system resolves name from.

Step 2, get the source code for your syslogd and recompile it, make sure you tell syslog no to truncate domain suffix. while youre at it, reroute your syslog.conf file to another location. security trick! then leave your existing /etc/syslog.conf intact. but you make all your new config changes in the new file only you know of.

peace
Donny