SC4S strips domain name, causes issues with interfaces reporting, can we use FQDN?

[twellinghurst]

We are migrating our syslog server to Splunk Connect 4 Syslog running on a RHEL server inside a Docker container. The syslog messages are being forwarded to Splunk, however, SC4S is stripping the domain name off of the device names, causing issues with interfaces that are sending log messages.

For example, the host - "hostname.contoso.com", will have the host= hostname, while the hostname
"lo0.hostname.contoso.com.", will have the host = lo0.

It appears SC4S is doing some sort of split on the first period (.) in the hostname and only keeping the first item in the array.

Is it possible to tell SC4S to use the FQDN as the hostname?

We are using reverse DNS on the SC4S instance - ie. SC4S_USE_REVERSE_DNS=yes

Any help is much appreciated!!

[rjha-splunk]

If you can share the device name and sample raw message including PRI we can check and help, the pcap is best way to see whats going on, also create a github issue for tracking purposes.

[twellinghurst]

Here is an example with the hostnames modified for security:

Below is a tcpdump on the sc4s host:

tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:39:57.718858 IP (tos 0x0, ttl 251, id 11762, offset 0, flags [none], proto UDP (17), length 167)
lo0.hostname.contoso.com.51204 > sc4s.contoso.com.syslog: SYSLOG, length: 139
Facility local7 (23), Severity warning (4)
Msg: 376917: Sep 21 09:40:12.192 EDT: %SW_MATM-4-MACFLAP_NOTIF: Host xxxx.xxxx.xxxx in vlan 216 is flapping between port Po79 and port Po81
09:40:13.621790 IP (tos 0x0, ttl 251, id 11763, offset 0, flags [none], proto UDP (17), length 167)
lo0.hostname.contoso.com.51204 > sc4s.contoso.com.syslog: SYSLOG, length: 139
Facility local7 (23), Severity warning (4)
Msg: 376918: Sep 21 09:40:28.098 EDT: %SW_MATM-4-MACFLAP_NOTIF: Host xxxx.xxxx.xxxx in vlan 216 is flapping between port Po83 and port Po85

When searching for this in Splunk Cloud it becomes:

[twellinghurst]

It looks like the issue is within package/etc/pylib/parser_fix_dns.py - Is there a way to override this behavior to use the FQDN?

`class FixHostResolver(LogParser):
def parse(self, log_message):

    # try to resolve the IP address
    try:
        ipaddr = log_message.get_as_str("SOURCEIP", "", repr="internal")

        hostname, aliaslist, ipaddrlist = socket.gethostbyaddr(ipaddr)
        **parts = str(hostname).split(".")
        name = parts[0]**
        if len(parts) > 1:
            log_message["HOST"] = name
    except Exception:
        return False

    # return True, other way message is dropped
    return True`