Loading ...
Sorry, an error occurred while loading the content.

resolving all IPs in logfiles, instead of resolving in webalizer

Expand Messages
  • enventa2000
    Hello: If you Apache, you ll surely have an utility called logresolve . It parses the Apache logfiles and resolves all IPs it encounters there. logresolve
    Message 1 of 3 , May 4, 2004
    • 0 Attachment
      Hello:

      If you Apache, you'll surely have an utility called "logresolve". It
      parses the Apache logfiles and resolves all IPs it encounters there.

      logresolve < access_log_not_resolved > access_log_resolved

      It will parse "access_log_not_resolved" and will create
      "access_log_resolved". Change names accordingly.

      It may take more than one hour for 100 megas of logs, but you only
      need to run it once.

      You can convert all logs with only IPs on it to resolved logs, so you
      can deactive the dns resolving in webalizer so it goes faster. It also
      understand logs where some IPs have already been resolved and others
      haven't.

      You can desactive the HostnameLookup feature in Apache so it runs
      faster, and then run logresolve on the rotated logs, so you have the
      best of both worlds.

      It seems to be able to understand Common and Combined logs from
      servers others from Apache (I tried a caucho.resin log and it worked).
    • waldo kitty
      ... we need to be careful with statements like this... some of these utils are not available on other operating systems that apache runs on... in my case,
      Message 2 of 3 , May 4, 2004
      • 0 Attachment
        enventa2000 wrote:
        > Hello:
        >
        > If you Apache, you'll surely have an utility called "logresolve". It
        > parses the Apache logfiles and resolves all IPs it encounters there.

        we need to be careful with statements like this... some of these utils are not available on other operating systems that apache runs
        on... in my case, IBM's OS/2 Warp 3 ;)

        [trim]

        > You can convert all logs with only IPs on it to resolved logs, so you
        > can deactive the dns resolving in webalizer so it goes faster. It also
        > understand logs where some IPs have already been resolved and others
        > haven't.

        even better would be to let apache resolve the addresses, wouldn't it? if apache can't resolve the address, no other tool will be
        able to resolve them either... in many cases, anyway...

        > You can desactive the HostnameLookup feature in Apache so it runs
        > faster, and then run logresolve on the rotated logs, so you have the
        > best of both worlds.

        but your system still spends the same time (or longer) when you resolve after the fact, doesn't it?


        --
        _\/
        (@@) Waldo Kitty, Waldo's Place USA
        __ooO_( )_Ooo_____________________ telnet://bbs.wpusa.dynip.com
        _|_____|_____|_____|_____|_____|_____ http://www.wpusa.dynip.com
        ____|_____|_____|_____|_____|_____|_____ ftp://ftp.wpusa.dynip.com
        _|_Eat_SPAM_to_email_me!_YUM!__|_____|_____ wkitty42 -at- alltel.net
      • enventa2000
        ... [snip] ... utils are not available on other operating systems that apache runs ... ops, you are right, I use RedHat 9.0, which is filled (or bloated) with
        Message 3 of 3 , May 5, 2004
        • 0 Attachment
          > > If you Apache, you'll surely have an utility called "logresolve".
          [snip]
          > we need to be careful with statements like this... some of these
          utils are not available on other operating systems that apache runs
          > on... in my case, IBM's OS/2 Warp 3 ;)

          ops, you are right, I use RedHat 9.0, which is filled (or bloated)
          with lot of utilities that I will never use.

          Anyways, it is very useful when you have not resolved logfiles. I'm
          sure there are similar utilities and even scripts, but I don't konw
          them.

          [snip]

          > even better would be to let apache resolve the addresses, wouldn't
          it? if apache can't resolve the address, no other tool will be
          > able to resolve them either... in many cases, anyway...
          >

          Since logresolve is provided with Apache, they will both have the same
          abilities.


          > > You can desactive the HostnameLookup feature in Apache so it runs
          > > faster, and then run logresolve on the rotated logs, so you have
          the
          > > best of both worlds.
          >
          > but your system still spends the same time (or longer) when you
          resolve after the fact, doesn't it?


          Yes, but Apache resolves the addresses while it is at the same time
          atempting to serve the pages. Sites where Apache takes too much time
          to serve the pages may attempt to desactive the feature. If anything
          goes wrong, they can still resolve the non-resolved logs later.
          tel.net
        Your message has been successfully submitted and would be delivered to recipients shortly.