Documentation forKiwi Syslog Server

DNS caching — Legacy

This documentation is for legacy Kiwi Syslog Server versions 9.8.3 and older.

Every time an IP address to hostname resolution is needed, the DNS server is queried. This can be an extra overhead on the program, the network and the DNS server, especially if you receive lots of messages.

To reduce the DNS traffic and resolution time, a DNS cache is used. Once a hostname has been resolved the result is stored locally. The next time that address needs to be resolved, the result is taken from the cache instead of making another DNS request.

The registered version can hold up to 20,000 entries.

  1. Choose File > Setup to open the Kiwi Syslog Server Setup dialog box.
  2. Expand the DNS Resolution node.
  3. Click DNS Caching.

  4. Under Entries in the cache:

    View button

    This dumps all the current cache entries into a file and then views the file with notepad. Information about the cache performance is also displayed.
    Refresh button

    Counts the number of valid entries currently in the cache.
    Clear button

    This will clear all the dynamic (learned from DNS lookups) entries. It won't clear the static entries that have been loaded from file.
    Clear All button This will clear the entire DNS cache of all the entries (static and dynamic). A program restart is required to re-read the static entry file again.

  5. UnderCache settings:

    Flush entries after X minutes

    This option allows old cached entries to be flushed from the cache after a specified time. By default a time to live of 1440 minutes (1 day) is used. After an entry has been in the cache for a day, it will be flushed from the cache and have to be re-learned via a lookup.
    Enable preemptive lookup of IP addresses

    Instead of looking up each address sequentially, this option will extract the IP addresses from the message before it is added to the processing queue. The addresses will be asynchronously resolved and the results cached. When the message is processed seconds later, the results will already be available in the cache. The DNS resolution is done via a multi-threaded lookup system that can handle up to 100 simultaneous lookups. If you are receiving lots of messages and want to resolve IP addresses as they arrive, it is highly recommended that this option be enabled.
    Pre-load the cache with static entries from a hosts file

    Enabling this option will cause the program to load a list of static host entries at start-up. The list must contain IP addresses and host names separated by a tab character. The addresses are loaded into the cache and marked as static, this means they will never expire and won't be flushed like the dynamically learned entries.

    An example host file is included in the install folder. It is named "StaticHosts.txt".

    Example of a host file:

    # Static DNS host file
# Each entry must have an IP address, a tab, then a host name
# The IP address is in the format aaa.bbb.ccc.ddd
# The host name can be any text value up to 63 characters
#
# Comments can be on a separate line and start with a # 
#
# Example:
# 192.168.1.1   myhost.mycompany.com
#
# NOTE: The IP address and host name MUST be separated 
# with a tab (ASCII chr 9)
# Spaces will not be recognized as a valid separator
# Default value for localhost
127.0.0.1   localhost
# local machines
192.168.1.2   myfunny.valentine.com
192.168.1.5   flyme2.themoon.com
  6. Click Apply to save your changes.