topic Re: Logs & Monitoring - Reverse DNS lookups incorrect in Firewall and Security Management

Logs & Monitoring - Reverse DNS lookups incorrect

Michael_Horne — Fri, 16 Nov 2018 12:21:50 GMT

Hello,

I have been looking for information about how the reverse DNS lookup works for the "logs" in R80.10. The issue we have is that the FQDN being displayed in the Logs is incorrect. In the log view ZRH-L00053" is displayed for the IP 10.166.138.158

When we check the DNS on the management server the host ZRH-D00008 is the actual owner of this IP Address in both directions and ZRH-L00053 maps to another IP

If anyone has any information about how this reverse DNS lookup is working it would be great

Many thanks,

Michael

Re: Logs & Monitoring - Reverse DNS lookups incorrect

PhoneBoy — Fri, 16 Nov 2018 19:07:36 GMT

Curious, what does the DNS on the gateway that accepted/blocked the traffic say about this IP?

As far as I know, this is resolved on the management station.

You might also look at the local hosts file on the management station to see if it say something different as I believe that will take precedence.

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Michael_Horne — Thu, 22 Nov 2018 10:39:12 GMT

HI,

Your assumptions match up with mine. In the end as a work around I restarted the management server as a way to force the server to re-query the DNS for the information. I bit extreme, I found not other information about how to reset the DNS cache on the device.

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Scott_Chambers — Fri, 03 May 2019 22:13:45 GMT

Did you run into any other issues since?
I just noticed we are having the same problem on our management server (R80.20 JHF 47).

Can resolve properly with the correct PTR when doing a nslookup from our management server, log server and smartconsole machine but logs simply don't update.

Is there any DNS cache clear on the management server verses a reboot?

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Scott_Chambers — Tue, 14 May 2019 15:35:22 GMT

Well.....we opened a TAC case on this one. We got a runaround at first about how PTR works overall but quickly got TAC to focus on the real issue: The management/log server.

TAC had us go through DNS cache clears on the smartconsole machine but no changes.

Last night, we rebooted both of our management and log servers per TAC's request (and only after referencing this thread).

Today.......all is resolving correctly 🙂

So.....now we are pushing TAC on 'why' this occurred and 'how' this can be prevented going forward.

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Enrico — Wed, 19 Jun 2019 17:13:07 GMT

Hello Scott,

have you had any update from TAC? I'm wandering if there is a solution to the problem because I'm experiencing the same trouble on R80.30 environment. I also found that using smartconsole I get wrong resolution, using old Smartview tracker hidden in the console folder ip are correctly resolved.

Maybe it just use a different cache...

Thank you for sharing

Enrico

Re: Logs & Monitoring - Reverse DNS lookups incorrect

LadaNemecek — Thu, 02 Dec 2021 20:56:08 GMT

Hi,

top this thread. Were the TAC helpful with describing the issue and privide resolution, reboot of machines its not a solution. And cannot find the way how to clear dns cache (hard to say if would help). Found similar issue on R81 mgmt

Thanks

Re: Logs & Monitoring - Reverse DNS lookups incorrect

CheckPointerXL — Fri, 25 Feb 2022 16:15:37 GMT

Hello,

same problem here, i'm on R81.

Anyone solved?

thank you

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Robin_H — Wed, 10 Jan 2024 12:18:39 GMT

Same on R81.10.

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Chris_Atkinson — Wed, 10 Jan 2024 13:38:40 GMT

I'll link you to a possible resolution shortly, just need to revisit my archives on the issue.

Re: Logs & Monitoring - Reverse DNS lookups incorrect

Chris_Atkinson — Wed, 10 Jan 2024 13:45:41 GMT

Perhaps this thread may help you:

https://community.checkpoint.com/t5/Management/SMS-log-incorrect-name-resolution/m-p/154523/highlight/true#M31568