[rsyslog] v8.39 rsyslogd: omfwd: could not get addrinfo for hostname 'z2500':'10514': Name or service not known

Discussion:

sophie.loewenthal--- via rsyslog

2018-12-04 13:16:11 UTC

Hi,

This error popped up in the logs:
2018-12-04T14:00:20.567320+01:00 z3001 rsyslogd: omfwd: could not get addrinfo for hostname 'z2500':'10514': Name or service not known [v8.39.0 try http://www.rsyslog.com

I have this action configured, and this looks ok to me.
The host can be resolved locally, and I can see traffic sent in tcpdump as shown below,

# RuleSet
*.info { action (type="omfwd"
target="z2500"
port="10514"
template="ElasticSearchTemplate"
name=" z2500-514-out"
queue.size="1024000"
queue.filename=" z2500-10514.queue"
queue.spoolDirectory="/soft/rsyslog/queues"
queue.maxdiskspace="512m"
queue.type="FixedArray"
queue.maxfilesize="20m"
queue.saveonshutdown="on"
queue.discardseverity="6"
queue.dequeueBatchSize="4096"
queue.workerthreads="2"
queue.workerthreadMinimumMessages="102400"
Action.ResumeInterval="1"
Action.ResumeRetryCount="-1"
)
}

# tcpdump -AttttnnvvS port 10514

# 2018-12-04 14:11:38.249110 IP (tos 0x0, ttl 64, id 5449, offset 0, flags [DF], proto UDP (17), length 206)
198.168.162.40.41830 > 198.168.87.188.10514: [bad udp cksum 0x0fba -> 0xd235!] UDP, length 178
***@.@...
L.(
.W..f).....{"timestamp":"2018-12-04T14:10:01.924663+01:00","message":" Removed slice User Slice of root.","host":"z2500","severity":"info","facility":"daemon","syslogtag":"systemd:"}

Is something else causing this Name or service not known error message?

Best wishes,
Sophie

This message and any attachments (the "message") is
intended solely for the intended addressees and is confidential.
If you receive this message in error,or are not the intended recipient(s),
please delete it and any copies from your systems and immediately notify
the sender. Any unauthorized view, use that does not comply with its purpose,
dissemination or disclosure, either whole or partial, is prohibited. Since the internet
cannot guarantee the integrity of this message which may not be reliable, BNP PARIBAS
(and its subsidiaries) shall not be liable for the message if modified, changed or falsified.
Do not print this message unless it is necessary, consider the environment.

----------------------------------------------------------------------------------------------------------------------------------

Ce message et toutes les pieces jointes (ci-apres le "message")
sont etablis a l'intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur ou s'il ne vous est pas destine,
merci de le detruire ainsi que toute copie de votre systeme et d'en avertir
immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de
ce message qui n'est pas conforme a sa destination, toute diffusion ou toute
publication, totale ou partielle, est interdite. L'Internet ne permettant pas d'assurer
l'integrite de ce message electronique susceptible d'alteration, BNP Paribas
(et ses filiales) decline(nt) toute responsabilite au titre de ce message dans l'hypothese
ou il aurait ete modifie, deforme ou falsifie.
N'imprimez ce message que si necessaire, pensez a l'environnement.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

John Chivian

2018-12-04 14:49:13 UTC

Permalink

The error message indicates an error in name lookup, not an error in
rsyslog. The first thing you should look at is the order in which name
resolution is to occur as specified on the "hosts" entry in
/etc/nsswitch.conf. If you must rely on DNS (or any network service) to
resolve the name, then you must be prepared for occasional resolution
failures.

If the address for z2500 never changes then you could put an entry for
it in /etc/hosts and list "files" as the first element of the "hosts" entry.

Regards,

Post by sophie.loewenthal--- via rsyslog
Hi,
2018-12-04T14:00:20.567320+01:00 z3001 rsyslogd: omfwd: could not get addrinfo for hostname 'z2500':'10514': Name or service not known [v8.39.0 try http://www.rsyslog.com
I have this action configured, and this looks ok to me.
The host can be resolved locally, and I can see traffic sent in tcpdump as shown below,
# RuleSet
*.info { action (type="omfwd"
target="z2500"
port="10514"
template="ElasticSearchTemplate"
name=" z2500-514-out"
queue.size="1024000"
queue.filename=" z2500-10514.queue"
queue.spoolDirectory="/soft/rsyslog/queues"
queue.maxdiskspace="512m"
queue.type="FixedArray"
queue.maxfilesize="20m"
queue.saveonshutdown="on"
queue.discardseverity="6"
queue.dequeueBatchSize="4096"
queue.workerthreads="2"
queue.workerthreadMinimumMessages="102400"
Action.ResumeInterval="1"
Action.ResumeRetryCount="-1"
)
}
# tcpdump -AttttnnvvS port 10514
# 2018-12-04 14:11:38.249110 IP (tos 0x0, ttl 64, id 5449, offset 0, flags [DF], proto UDP (17), length 206)
198.168.162.40.41830 > 198.168.87.188.10514: [bad udp cksum 0x0fba -> 0xd235!] UDP, length 178
L.(
.W..f).....{"timestamp":"2018-12-04T14:10:01.924663+01:00","message":" Removed slice User Slice of root.","host":"z2500","severity":"info","facility":"daemon","syslogtag":"systemd:"}
Is something else causing this Name or service not known error message?
Best wishes,
Sophie
This message and any attachments (the "message") is
intended solely for the intended addressees and is confidential.
If you receive this message in error,or are not the intended recipient(s),
please delete it and any copies from your systems and immediately notify
the sender. Any unauthorized view, use that does not comply with its purpose,
dissemination or disclosure, either whole or partial, is prohibited. Since the internet
cannot guarantee the integrity of this message which may not be reliable, BNP PARIBAS
(and its subsidiaries) shall not be liable for the message if modified, changed or falsified.
Do not print this message unless it is necessary, consider the environment.
----------------------------------------------------------------------------------------------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le "message")
sont etablis a l'intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur ou s'il ne vous est pas destine,
merci de le detruire ainsi que toute copie de votre systeme et d'en avertir
immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de
ce message qui n'est pas conforme a sa destination, toute diffusion ou toute
publication, totale ou partielle, est interdite. L'Internet ne permettant pas d'assurer
l'integrite de ce message electronique susceptible d'alteration, BNP Paribas
(et ses filiales) decline(nt) toute responsabilite au titre de ce message dans l'hypothese
ou il aurait ete modifie, deforme ou falsifie.
N'imprimez ce message que si necessaire, pensez a l'environnement.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'

sophie.loewenthal--- via rsyslog

2018-12-05 11:38:34 UTC

Permalink

Thanks John. Guess DNS was ill at that moment. It's working now

-----Original Message-----
Chivian
Sent: Tuesday, December 04, 2018 3:49 PM
Subject: Re: [rsyslog] v8.39 rsyslogd: omfwd: could not get addrinfo for
hostname 'z2500':'10514': Name or service not known
The error message indicates an error in name lookup, not an error in
rsyslog. The first thing you should look at is the order in which name
resolution is to occur as specified on the "hosts" entry in
/etc/nsswitch.conf. If you must rely on DNS (or any network service) to
resolve the name, then you must be prepared for occasional resolution
failures.
If the address for z2500 never changes then you could put an entry for
it in /etc/hosts and list "files" as the first element of the "hosts" entry.
Regards,

Post by sophie.loewenthal--- via rsyslog
Hi,
2018-12-04T14:00:20.567320+01:00 z3001 rsyslogd: omfwd: could not get

addrinfo for hostname 'z2500':'10514': Name or service not known [v8.39.0 try
http://www.rsyslog.com

Post by sophie.loewenthal--- via rsyslog
I have this action configured, and this looks ok to me.
The host can be resolved locally, and I can see traffic sent in tcpdump as

shown below,

Post by sophie.loewenthal--- via rsyslog
# RuleSet
*.info { action (type="omfwd"
target="z2500"
port="10514"
template="ElasticSearchTemplate"
name=" z2500-514-out"
queue.size="1024000"
queue.filename=" z2500-10514.queue"
queue.spoolDirectory="/soft/rsyslog/queues"
queue.maxdiskspace="512m"
queue.type="FixedArray"
queue.maxfilesize="20m"
queue.saveonshutdown="on"
queue.discardseverity="6"
queue.dequeueBatchSize="4096"
queue.workerthreads="2"
queue.workerthreadMinimumMessages="102400"
Action.ResumeInterval="1"
Action.ResumeRetryCount="-1"
)
}
# tcpdump -AttttnnvvS port 10514
# 2018-12-04 14:11:38.249110 IP (tos 0x0, ttl 64, id 5449, offset 0, flags [DF],

proto UDP (17), length 206)

Post by sophie.loewenthal--- via rsyslog
198.168.162.40.41830 > 198.168.87.188.10514: [bad udp cksum 0x0fba ->

0xd235!] UDP, length 178

Post by sophie.loewenthal--- via rsyslog
L.(
.W..f).....{"timestamp":"2018-12-04T14:10:01.924663+01:00","message":"

Removed slice User Slice of
root.","host":"z2500","severity":"info","facility":"daemon","syslogtag":"systemd
:"}

Post by sophie.loewenthal--- via rsyslog
Is something else causing this Name or service not known error message?
Best wishes,
Sophie
This message and any attachments (the "message") is
intended solely for the intended addressees and is confidential.
If you receive this message in error,or are not the intended recipient(s),
please delete it and any copies from your systems and immediately notify
the sender. Any unauthorized view, use that does not comply with its purpose,
dissemination or disclosure, either whole or partial, is prohibited. Since the

internet

Post by sophie.loewenthal--- via rsyslog
cannot guarantee the integrity of this message which may not be reliable, BNP

PARIBAS

Post by sophie.loewenthal--- via rsyslog
(and its subsidiaries) shall not be liable for the message if modified, changed or

falsified.

Post by sophie.loewenthal--- via rsyslog
Do not print this message unless it is necessary, consider the environment.
-----------------------------------------------------------------------------------------------

-----------------------------------

Post by sophie.loewenthal--- via rsyslog
Ce message et toutes les pieces jointes (ci-apres le "message")
sont etablis a l'intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur ou s'il ne vous est pas destine,
merci de le detruire ainsi que toute copie de votre systeme et d'en avertir
immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de
ce message qui n'est pas conforme a sa destination, toute diffusion ou toute
publication, totale ou partielle, est interdite. L'Internet ne permettant pas

d'assurer

Post by sophie.loewenthal--- via rsyslog
l'integrite de ce message electronique susceptible d'alteration, BNP Paribas
(et ses filiales) decline(nt) toute responsabilite au titre de ce message dans

l'hypothese

Post by sophie.loewenthal--- via rsyslog
ou il aurait ete modifie, deforme ou falsifie.
N'imprimez ce message que si necessaire, pensez a l'environnement.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of

sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.