News for hackers. Stuff that matters.
Re:Log4j RCE Found by est on Friday December 10, 2021 @12:11AM (#29506639)
I do, but with a different log aggregator (vector.dev), there are three reasons:

1. the log aggregator doesn't exactly support DNS lookups

2. You have to parse the log first, exactly precisely where the IP part, then do a proper lookup. But sometimes the log is just a mess.

3. where the log aggregator located cannot do host lookup because of different network and different DNS server.

So overall the lookup would better be done locally.

There are no comments on this comment yet.