(Apache) does not undertake to reverse-resolve the IP address into a domain name.

Of course it does. That's the entire purpose of HostnameLookups.

No, it doesn't. Because your local resolver has already preformed that task for Apache. :-)

The first example was bare as possible to show the basic principle. In practice logs have lots of redundancy so you should cache and handle lookup errors. If this was run for a very long time or a super busy site you'd clear the cache once in a while too (with Vins reminder that gethostbyaddr is obsolete (and slow)):

use strict;
use feature qw(say);
use Socket;
use File::Tail;

my $file = File::Tail->new("/some/log/file");
my $seen = {};
my $line;

while (defined($line = $file->read)) {
    if ($line =~ /^DATE (IP) (WHATEVER)/) {
       my $remote_ip   = $1;
       my $whatever    = $2;
       my $remote_host;

       if ($seen->{$remote_ip}) {
           $remote_host = $seen->{$remote_ip};
       else {
           $remote_host = getaddrinfo(inet_pton($remote_ip),AF_INET) |
+| 'none';
           $seen->{$remote_ip} = $remote_host;
       }
       say join "\t", qw/$remote_ip $remote_host $whatever/;
    }
}
[download]

Thanks AM, for the followup, and additional work!

As I look at your work. It appeals more to me as a "post processing" script. In that I could easily resolve the IP's ($1), and preserve the rest of the fields ($n - $n), and dump the array back to a file, with only the IP address field having been changed. So I really loose nothing, as it was originally logged, but the IP which, (if resolvable) becomes a hostname -- well... save the additional time. :-). Nice!

Thanks again, AM!

--Chris

Evil is good, for without it, Good would have no value
¡λɐp ʇɑəɹ⅁ ɐ əʌɐɥ puɐ ʻꜱdləɥ ꜱᴉɥʇ ədoH