Re: how to resolve IP's in an HTTPd that doesn't resolve them?

So, Perl will give me what the HTTPD won't -- I love Perl! So how might I best achieve the same simultaneously within my HTTPd logs?

Use Perl Glue! DO NOT resolve logs with your httpd. <- Period. Use File::Tail to give your logfile a Perl API so you can watch it in realtime from your own program. Parse each line, capture the IP, resolve it and print whatever you want:


use strict;
use feature qw(say);
use Socket;
use File::Tail;

my $file = File::Tail->new("/some/log/file");
my $line;

while (defined($line = $file->read)) {
    if ($line =~ /^DATE (IP) (WHATEVER)/) {
       my $remote_ip   = $1;
       my $whatever    = $2;
       my $remote_host = gethostbyaddr(inet_aton($remote_ip),AF_INET);
       say join "\t", qw/$remote_ip $remote_host $whatever/;
    }
}
[download]

Comment on Re: how to resolve IP's in an HTTPd that doesn't resolve them? Download Code

Replies are listed 'Best First'.
Re^2: how to resolve IP's in an HTTPd that doesn't resolve them? by VinsWorldcom (Prior) on Jun 14, 2018 at 11:28 UTC
AGREE! I'm no expert at this, but when I did do it long ago with my own personal web server, Apache just logged IPs and the Perl script I wrote for post log processing (and long since lost) did name resolution, concatenation and statistics and emailed summary to me. As long as we're on the topic of name resolution, you may not yet care about IPv6, but rather than rewriting your code later when you do, start with the address family independent resolution calls rather than the legacy ones: gethostbyname => getnameinfo gethostbyaddr => getaddrinfo inet_ntoa => inet_ntop inet_aton => inet_pton Perl Socket module has had support since around version 1.94 (Perl 5.14 or there-abouts). A brief example that can be reduced but should be compatible with Socket modules of a certain earlier version that had the new routines, but no IPv6 support: #!/usr/bin/perl use strict; use warnings; use Socket qw(inet_ntoa AF_INET IPPROTO_TCP); my $AF_INET6 = eval { Socket::AF_INET6() }; my $AF_UNSPEC = eval { Socket::AF_UNSPEC() }; my $AI_NUMERICHOST = eval { Socket::AI_NUMERICHOST() }; my $NI_NUMERICHOST = eval { Socket::NI_NUMERICHOST() }; # Required for reverse lookup my $NI_NAMEREQD = eval { Socket::NI_NAMEREQD() }; my %hints = ( family => $AF_UNSPEC, protocol => IPPROTO_TCP ); my ( $err, @getaddr ) = Socket::getaddrinfo( $ARGV[0], undef, \%hints +); if ( defined( $getaddr[0] ) ) { for my $addr (@getaddr) { my ( $err, $address ) = Socket::getnameinfo( $addr->{addr}, $NI_NUMERICHOST ); printf "getaddrinfo()/getnameinfo() Address = %s\n", ( defined($address) ) ? $address : $err; # Reverse Lookup my ( $host, $service ); ( $err, $host, $service ) = Socket::getnameinfo( $addr->{addr}, $NI_NAMEREQD ); printf " \|_> getnameinfo() Name = %s\n", ( defined($host) ) ? $host : $err; } } else { print "$0: getaddrinfo() failed - error = $err\n"; } [download] and run ... `C:\> test.pl www.google.com getaddrinfo()/getnameinfo() Address = 172.217.15.100 \|_> getnameinfo() Name = iad30s21-in-f4.1e100.net` [download]	[reply] [d/l] [select]
Re^3: how to resolve IP's in an HTTPd that doesn't resolve them? by taint (Chaplain) on Jun 14, 2018 at 14:55 UTC
Wonderful example, VinsWorldcom . Thanks! Right you are; IPv6 should indeed be considered. I hadn't really blocked the whole process out yet. As I wanted to first look at just how it be best implemented up front -- what all the possibilities that might be available. I too used Socket in my OP. As well as inet_aton. But hadn't (yet) bothered with IPv6 resolution. But will be adding it. Thank you for such an elaborate example ++ ! Thanks again, VinsWorldcom ! With yours, as well as the other excellent examples above. I feel pretty well armed for the task! :-) --Chris Evil is good, for without it, Good would have no value Ąλɐp ʇɑəɹ⅁ ɐ əʌɐɥ puɐ ʻꜱdləɥ ꜱᴉɥʇ ədoH	[reply]
Re^2: how to resolve IP's in an HTTPd that doesn't resolve them? by taint (Chaplain) on Jun 14, 2018 at 14:35 UTC
Good advice Anonymous Monk ! ...and only adds slightly more than I'm already using in the web page example I posted in the OP Thanks! --Chris Evil is good, for without it, Good would have no value Ąλɐp ʇɑəɹ⅁ ɐ əʌɐɥ puɐ ʻꜱdləɥ ꜱᴉɥʇ ədoH	[reply]


more useful options
	PerlMonks