[WEB4LIB] RE: DNS Resolution of Log Files with Numeric IP Addresses

[Roy Tennant]

Following up on Darryl's comment on the lack of a significant 
performance hit when turning on IP resolution, I've learned to view 
such claims with skepticism. I've known system administrators to also 
oppose parsing all HTML files for server side includes for the same 
reason, despite the fact that there is no available evidence to back up 
such a claim. When I've been able to marshall evidence to the contrary, 
I've been able to have such services turned on with (you guessed it) no 
discernable problem. I would encourage everyone who is being denied 
such service by their system administrator for reasons of system 
performance to go to the mat on it, backed up by testimony from those 
who have turned on such services with no ill effect (you can quote me). 
Thanks,
Roy


On Mar 9, 2005, at 7:45 AM, Darryl Friesen wrote:

>> I'm looking for a program that will take a Web log with numeric IP
>> addresses, do a DNS lookup on them, and write the resolved address
>> back to the log file.  I am interested in doing this so that there
>> is a permanent record of the resolved address in a log file that
>> can be analyzed at any future date without having to deal with the
>> problem that IP addresses constantly change.  (I know that Web
>> servers can do DNS resolution as they write logs; that feature has
>> been turned off for performance reasons).
>
> Eric has already recommended a good DNS resolver, so I won't bother.  
> I will
> say that, depending on your network, your resolved web server log may 
> not be
> accurate. If your institution uses dynamic assignement of IP addresses 
> and
> hostnames, it's possible that the hostname you get when you look up 
> the IP
> address may not be the same as when the actual request was made.  For
> example, my desktop machine has a static hostname (gollum.usask.ca) 
> but a
> dynamic IP address.  If I were to lookup the IP address from our log 
> file
> for a request made a week ago, it's very likely that the IP address 
> will not
> resolve to gollum.usask.ca, but some other machine in my department.
>
> We got around this by having our Apache server to the DNS lookups for 
> us
> again (we too had it turned off), and haven't noticed that much of an 
> impact
> on performance.  It's important for us to know, at the time of the 
> request,
> what the hostname of the computer is.
>
> This may not be a factor for you, but I thought I'd point it out.
>
>
> - Darryl
>
>  ----------------------------------------------------------------------
>   Darryl Friesen, B.Sc., Programmer/Analyst    Darryl.Friesen at usask.ca
>   Education & Research Technology Services,     http://gollum.usask.ca/
>   Information Technology Services Division,
>   University of Saskatchewan
>  ----------------------------------------------------------------------
>   "Go not to the Elves for counsel, for they will say both no and yes"
>
>
>
>
>