Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options
 
PerlMonks  

Re: how to resolve IP's in an HTTPd that doesn't resolve them?

by Anonymous Monk
on Jun 14, 2018 at 08:30 UTC ( [id://1216616] : note . print w/replies, xml ) Need Help??


in reply to how to resolve IP's in an HTTPd that doesn't resolve them?

So, Perl will give me what the HTTPD won't -- I love Perl! So how might I best achieve the same simultaneously within my HTTPd logs?

Use Perl Glue! DO NOT resolve logs with your httpd. <- Period. Use File::Tail to give your logfile a Perl API so you can watch it in realtime from your own program. Parse each line, capture the IP, resolve it and print whatever you want:

use strict; use feature qw(say); use Socket; use File::Tail; my $file = File::Tail->new("/some/log/file"); my $line; while (defined($line = $file->read)) { if ($line =~ /^DATE (IP) (WHATEVER)/) { my $remote_ip = $1; my $whatever = $2; my $remote_host = gethostbyaddr(inet_aton($remote_ip),AF_INET); say join "\t", qw/$remote_ip $remote_host $whatever/; } }

Replies are listed 'Best First'.
Re^2: how to resolve IP's in an HTTPd that doesn't resolve them?
by VinsWorldcom (Prior) on Jun 14, 2018 at 11:28 UTC

    AGREE! I'm no expert at this, but when I did do it long ago with my own personal web server, Apache just logged IPs and the Perl script I wrote for post log processing (and long since lost) did name resolution, concatenation and statistics and emailed summary to me.

    As long as we're on the topic of name resolution, you may not *yet* care about IPv6, but rather than rewriting your code later when you do, start with the address family independent resolution calls rather than the legacy ones:

    • gethostbyname => getnameinfo
    • gethostbyaddr => getaddrinfo
    • inet_ntoa => inet_ntop
    • inet_aton => inet_pton

    Perl Socket module has had support since around version 1.94 (Perl 5.14 or there-abouts). A brief example that can be reduced but should be compatible with Socket modules of a certain earlier version that had the new routines, but no IPv6 support:

    #!/usr/bin/perl use strict; use warnings; use Socket qw(inet_ntoa AF_INET IPPROTO_TCP); my $AF_INET6 = eval { Socket::AF_INET6() }; my $AF_UNSPEC = eval { Socket::AF_UNSPEC() }; my $AI_NUMERICHOST = eval { Socket::AI_NUMERICHOST() }; my $NI_NUMERICHOST = eval { Socket::NI_NUMERICHOST() }; # Required for reverse lookup my $NI_NAMEREQD = eval { Socket::NI_NAMEREQD() }; my %hints = ( family => $AF_UNSPEC, protocol => IPPROTO_TCP ); my ( $err, @getaddr ) = Socket::getaddrinfo( $ARGV[0], undef, \%hints +); if ( defined( $getaddr[0] ) ) { for my $addr (@getaddr) { my ( $err, $address ) = Socket::getnameinfo( $addr->{addr}, $NI_NUMERICHOST ); printf "getaddrinfo()/getnameinfo() Address = %s\n", ( defined($address) ) ? $address : $err; # Reverse Lookup my ( $host, $service ); ( $err, $host, $service ) = Socket::getnameinfo( $addr->{addr}, $NI_NAMEREQD ); printf " |_> getnameinfo() Name = %s\n", ( defined($host) ) ? $host : $err; } } else { print "$0: getaddrinfo() failed - error = $err\n"; }

    and run ...

    C:\> test.pl www.google.com getaddrinfo()/getnameinfo() Address = 172.217.15.100 |_> getnameinfo() Name = iad30s21-in-f4.1e100.net
      Wonderful example, VinsWorldcom . Thanks!

      Right you are; IPv6 should indeed be considered. I hadn't really blocked the whole process out yet. As I wanted to first look at just how it be best implemented up front -- what all the possibilities that might be available.

      I too used Socket in my OP. As well as inet_aton. But hadn't (yet) bothered with IPv6 resolution. But will be adding it. Thank you for such an elaborate example ++ !

      Thanks again, VinsWorldcom ! With yours, as well as the other excellent examples above. I feel pretty well armed for the task! :-)

      --Chris

      Evil is good, for without it, Good would have no value
      λɐp ʇɑəɹ⅁ ɐ əʌɐɥ puɐ ʻꜱdləɥ ꜱᴉɥʇ ədoH

Re^2: how to resolve IP's in an HTTPd that doesn't resolve them?
by taint (Chaplain) on Jun 14, 2018 at 14:35 UTC
    Good advice Anonymous Monk !

    ...and only adds slightly more than I'm already using in the web page example I posted in the OP

    Thanks!

    --Chris

    Evil is good, for without it, Good would have no value
    λɐp ʇɑəɹ⅁ ɐ əʌɐɥ puɐ ʻꜱdləɥ ꜱᴉɥʇ ədoH