---
title: Frequent Fluent Bit Restart Events
source: https://docs.newrelic.com/docs/infrastructure/infrastructure-troubleshooting/troubleshoot-infrastructure/frequent-fluent-bit-restart-events
---

## Problem

The New Relic infrastructure agent is sending excessive `Fluent Bit Started` and `Fluent Bit Stopped` events without actual Fluent Bit restarts. This can clutter logs, affect monitoring accuracy, and increase data ingestion, potentially leading to unexpected billing charges.

## Cause

This is caused by a bug in the infrastructure agent's hostname resolution component. The agent incorrectly detects frequent hostname changes, which triggers the `LogForwarderSupervisor` to send these false Fluent Bit restart events. You might see thousands of debug messages similar to the following example:

```
time="2024-04-20T02:46:47Z" level=debug msg="Notifying observers." change=2 component=HostnameResolver
time="2024-04-20T02:46:47Z" level=debug msg="Observer notified." component=HostnameResolver name=LogForwarderSupervisor
```

## Solution

To resolve this issue, modify the hostname resolution behavior in your infrastructure agent's configuration. This fix applies to both Windows and Linux systems.

Add the following configuration to your infrastructure agent configuration file:

**Linux**: `/etc/newrelic-infra.yml`
**Windows**: `C:\Program Files\New Relic\newrelic-infra\newrelic-infra.yml`

```yml
dns_hostname_resolution: false
override_hostname: "your-server-hostname"
```

Replace `"your-server-hostname"` with your actual server hostname.

This configuration:

-   Disables reverse DNS lookups that may be causing unstable hostname detection
-   Forces the agent to use a specific hostname, preventing any hostname change detection

### Apply the configuration

After you add the configuration:

1.  Save the configuration file.
2.  Restart the New Relic infrastructure agent:

    **Linux**:

    ```bash
    sudo systemctl restart newrelic-infra
    ```

    **Windows**:

    ```powershell
    Restart-Service newrelic-infra
    ```

## Verification

To confirm the issue is resolved:

1.  Monitor your infrastructure agent logs for the absence of repeated `HostnameResolver` messages.
2.  Check the New Relic dashboard to ensure that `Fluent Bit Started` and `Fluent Bit Stopped` events are no longer appearing continuously.
3.  Verify that log forwarding continues to function normally and that logs appear as configured.

## Additional resources

-   [Infrastructure agent hostname resolution documentation](https://github.com/newrelic/infrastructure-agent/blob/master/docs/hostname_resolution.md)
-   [Infrastructure agent configuration settings](https://docs.newrelic.com/docs/infrastructure/install-infrastructure-agent/configuration/infrastructure-agent-configuration-settings/)