http://qs1969.pair.com?node_id=1216641


in reply to Re: how to resolve IP's in an HTTPd that doesn't resolve them?
in thread how to resolve IP's in an HTTPd that doesn't resolve them?

A perlmonk (sundialsvc4) beat me to it as usual, here's some more:

The first example was bare as possible to show the basic principle. In practice logs have lots of redundancy so you should cache and handle lookup errors. If this was run for a very long time or a super busy site you'd clear the cache once in a while too (with Vins reminder that gethostbyaddr is obsolete (and slow)):

use strict; use feature qw(say); use Socket; use File::Tail; my $file = File::Tail->new("/some/log/file"); my $seen = {}; my $line; while (defined($line = $file->read)) { if ($line =~ /^DATE (IP) (WHATEVER)/) { my $remote_ip = $1; my $whatever = $2; my $remote_host; if ($seen->{$remote_ip}) { $remote_host = $seen->{$remote_ip}; else { $remote_host = getaddrinfo(inet_pton($remote_ip),AF_INET) | +| 'none'; $seen->{$remote_ip} = $remote_host; } say join "\t", qw/$remote_ip $remote_host $whatever/; } }

Replies are listed 'Best First'.
Re^3: how to resolve IP's in an HTTPd that doesn't resolve them?
by taint (Chaplain) on Jun 14, 2018 at 23:30 UTC
    Thanks AM, for the followup, and additional work!

    As I look at your work. It appeals more to me as a "post processing" script. In that I could easily resolve the IP's ($1), and preserve the rest of the fields ($n - $n), and dump the array back to a file, with only the IP address field having been changed. So I really loose nothing, as it was originally logged, but the IP which, (if resolvable) becomes a hostname -- well... save the additional time. :-). Nice!

    Thanks again, AM!

    --Chris

    Evil is good, for without it, Good would have no value
    ¡λɐp ʇɑəɹ⅁ ɐ əʌɐɥ puɐ ʻꜱdləɥ ꜱᴉɥʇ ədoH

A reply falls below the community's threshold of quality. You may see it by logging in.