Why does rsyslog daemon create a new directory in /var/rsyslog while using the "%fromhost%" parameter in the "$template" option in the rsyslog configuration and dns becomes unavailable?

Issue

• While using the %fromhost% parameter in the $template option in the rsyslog configuration on RHEL6 to gather some logging data from remote servers and dns is available the rsyslog daemon creates a directory in /var/rsyslog containing the hostname (which is desirable for us) and logs the data to this directory.

For example:

$template httpd_error,"/var/rsyslog/%fromhost%/httpd/error_log"
local4.* ?httpd_error

• But when the dns is unavailable and the TTL is expired from the remote host, the rsyslog daemon creates a second directory in /var/rsyslog containing the IP address of the remote host and logs the data to this directory. Thus syslog data from one host is now captured in two different directories.