Where the graylog pickup names for nodes?


(Charles Deng) #1

Hi All,

I have setup a 3-nodes graylog cluster. in the dns server, i put those A RR for those 3 servers:

$ORIGIN	mylogs.com.
...
	glc	IN	A	192.168.1.31
		IN	A	192.168.1.32
		IN	A	192.168.1.33
	gl1	IN	A	192.168.1.31
	gl2	IN	A	192.168.1.32
	gl3	IN	A	192.168.1.33

and PTR RR for those ip addresses:

$ORIGIN	1.168.192.in-addr.arpa.
...
	31	IN	PTR	glc.mylogs.com.
		IN	PTR	gl1.mylogs.com.
	32	IN	PTR	glc.mylogs.com.
		IN	PTR	gl2.mylogs.com.
	33	IN	PTR	glc.mylogs.com.
		IN	PTR	gl3.mylogs.com.

in the server.conf, i am using gl1.mylogs.com, gl2.mylogs.com, gl3.mylogs.com for the rest & web endpoints without touch to name of glc.mylogs.com. for example for first graylog node:

rest_listen_uri = https://gl1.mylogs.com:9000/api/
rest_transport_uri = https://gl1.mylogs.com:9000/api/
web_listen_uri = https://gl1.mylogs.com:9000/
web_endpoint_uri = https://gl1.mylogs.com:9000/api/

but i got two graylog node using glc.mylogs.com and one using gl3.mylogs.com as nodes’ names from the GUI System/Nodes:

this make me confused, so i want to know where the graylog cluster pickup the nodes’ names ?


(Jochen) #2

You’ve created PTR RR records so that 31.1.168.192.in-addr.arpa., 32.1.168.192.in-addr.arpa., and 33.1.168.192.in-addr.arpa. all resolve to glc.mylogs.com and that’s what Graylog is showing.


(Charles Deng) #3

do you mean the node put resolved ip address of hostname where the REST/Web binding to to the mongodb, and then system get reverse resolved names from dns with those ip addresses as nodes’ names?


(Jochen) #4

Yes, Graylog is resolving the hostnames for the IP addresses of each Graylog node and stores them.


(system) #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.