[WEB4LIB] RE: DNS Resolution of Log Files with Numeric IP Addresses

[Eric Hellman]

perhaps this is obvious, but DNS lookup will 
introduce significant overhead when used for a 
public web service (such as a university website) 
which may service users from tens of thousands of 
ip addresses from around the world. For a library 
website where 99% of users come from a few 
subnets, the overhead will be nil- the records 
are all going to be in the DNS server's cache if 
not in the local table.




At 8:24 AM -0800 3/9/05, Roy Tennant wrote:
>Following up on Darryl's comment on the lack of a significant
>performance hit when turning on IP resolution, I've learned to view
>such claims with skepticism. I've known system administrators to also
>oppose parsing all HTML files for server side includes for the same
>reason, despite the fact that there is no available evidence to back up
>such a claim. When I've been able to marshall evidence to the contrary,
>I've been able to have such services turned on with (you guessed it) no
>discernable problem. I would encourage everyone who is being denied
>such service by their system administrator for reasons of system
>performance to go to the mat on it, backed up by testimony from those
>who have turned on such services with no ill effect (you can quote me).
>Thanks,
>Roy
>
>
>On Mar 9, 2005, at 7:45 AM, Darryl Friesen wrote:
>
>>>  I'm looking for a program that will take a Web log with numeric IP
>>>  addresses, do a DNS lookup on them, and write the resolved address
>>>  back to the log file.  I am interested in doing this so that there
>>>  is a permanent record of the resolved address in a log file that
>>>  can be analyzed at any future date without having to deal with the
>>>  problem that IP addresses constantly change.  (I know that Web
>>>  servers can do DNS resolution as they write logs; that feature has
>>>  been turned off for performance reasons).
>>
>>  Eric has already recommended a good DNS resolver, so I won't bother. 
>>  I will
>>  say that, depending on your network, your resolved web server log may
>>  not be
>>  accurate. If your institution uses dynamic assignement of IP addresses
>>  and
>>  hostnames, it's possible that the hostname you get when you look up
>>  the IP
>>  address may not be the same as when the actual request was made.  For
>>  example, my desktop machine has a static hostname (gollum.usask.ca)
>>  but a
>>  dynamic IP address.  If I were to lookup the IP address from our log
>>  file
>>  for a request made a week ago, it's very likely that the IP address
>>  will not
>>  resolve to gollum.usask.ca, but some other machine in my department.
>>
>>  We got around this by having our Apache server to the DNS lookups for
>>  us
>>  again (we too had it turned off), and haven't noticed that much of an
>>  impact
>>  on performance.  It's important for us to know, at the time of the
>>  request,
>>  what the hostname of the computer is.
>>
>>  This may not be a factor for you, but I thought I'd point it out.
>>
>>
>>  - Darryl
>>
>>   ----------------------------------------------------------------------
>>    Darryl Friesen, B.Sc., Programmer/Analyst    Darryl.Friesen at usask.ca
>>    Education & Research Technology Services,     http://gollum.usask.ca/
>>    Information Technology Services Division,
>>    University of Saskatchewan
>>   ----------------------------------------------------------------------
>>    "Go not to the Elves for counsel, for they will say both no and yes"
>>
>>
>>
>>
>>


-- 

Eric Hellman, President                            Openly Informatics, Inc.
eric at openly.com                                    2 Broad St., 2nd Floor
tel 1-973-509-7800 fax 1-734-468-6216              Bloomfield, NJ 07003
http://www.openly.com/1cate/      1 Click Access To Everything