How to disable DNS hostname lookup in rsyslog?

Question

How do I configure rsyslog to write raw IP addresses instead of DNS names in log files for remote hosts?

Answer 1

In Debian, open /etc/defaults/rsyslog and modify:

RSYSLOGD_OPTIONS="-x -Q"

and then:

# service rsyslog restart

See man rsyslogd(8) for other possible options. This doesn't disable DNS names for all remote hosts, only some of them.

Answer 2

I use

fromhost-ip

instead of

hostname or source

fromhost-ip reference the host that send the packet to this rsyslog. It meant that if you have any relay intermediate system, the last one is the IP that you see. If you don't use relay this is a valid solution.

Answer 3

You need to create a new template and apply it on /etc/rsyslog.conf. You should create like these on:

$template myFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
$ActionFileDefaultTemplate myFormat