1

I have a Pi that's running a syslog server with rsyslog for my local network. The problem is when I enable it, the server spams the network with:

Dec  7 19:58:41 2016 SYSLOG[0]: [Host 192.168.0.1] UDP 192.168.0.52,47781 --> 8.8.8.8,53 ALLOW: Outbound access request [DNS query for 1.0.168.192.in-addr.arpa.]

Can I stop outbound traffic from the server because it's causing the network to identify it as Lan Sidr UDP flood attack?

1 Answer 1

1

To make rsyslog not do reverse DNS requests, edit /etc/rsyslog.conf and add:

global(net.enableDNS="off")

as described at the following link: http://www.rsyslog.com/doc/v8-stable/compatibility/v8compatibility.html#command-line-options

and then restart the service with:

service rsyslog restart

Please take note that adding -x to RSYSLOGD_OPTIONS in /etc/default/rsyslog is being deprecated, avoid it.

2
  • 1
    +1. The documentation even warns you that doing reverse DNS lookups on remote logs will cause a severe performance hit, and there really is no point in doing it. You can do the lookup easily enough when you're trying to retrieve some information, and the IP address is more pertinent than its current name. Dec 10, 2016 at 9:07
  • 1
    I added the net.enableDNS="off", and I also tried the RSYSLOGD_OPTIONS"-x", neither one stopped the flooding.
    – Mobalized
    Dec 10, 2016 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .