Re:Log4j RCE Found
by suraci on Thursday December 09, 2021 @10:04PM
(#29505980)
Why didn't write logs to stdout and scrape container log files by fluentbit/promtail/etc? I'm working on logging infrastructure now and really want to know the reason behind this(before I built it...)
[ Parent
| on HN ]
I do, but with a different log aggregator (vector.dev), there are three reasons:
1. the log aggregator doesn't exactly support DNS lookups
2. You have to parse the log first, exactly precisely where the IP part, then do a proper lookup. But sometimes the log is just a mess.
3. where the log aggregator located cannot do host lookup because of different network and different DNS server.
So overall the lookup would better be done locally.