This option specifies how many DNS resolver threads are used to resolve the sending host IP addresses, or the IP addresses found in the message text. If pre-emptive DNS lookup is enabled, all the IP addresses from the incoming messages are loaded into the DNS resolving queue. Up to 200 IP addresses can be resolved to hostnames at once.
The freeware version allows 1, 2, or 10 threads to be used.
The registered version allows up to 200 threads to be used.
Using more than 25 threads can impact system performance.
Please note:
Changes to this option only take effect after a program restart, or in the case of the Service Edition, after the service has been stopped and restarted.
If you are just resolving the IP addresses of the sending host, using 10 threads is normally adequate.
If you are also resolving the IP addresses found in the message text, then using 50 to 100 threads should be adequate.
When the flow of messages becomes too great to perform real-time DNS lookups, it is recommended that the DNS options be disabled. Instead, use a reporting tool to filter out a subset of the log file entries that you are interested in. Then use the reporting tool to resolve only those IP addresses to hostnames. For example, only resolve the top 20 IP addresses via the reporting tool, rather than all of them in real-time. This is much more efficient as most people are only interested in a subset of the log file entries, so it may be a waste of resources to resolve every IP address in real-time.