[dacreativeguy]

Can someone point me towards apps that perform reverse DNS lookups on raw web server log files?

I have a good command line utility to do this on Windows but haven't been able to find anything for the mac. There are a few that do one IP at a time, but I need one that will allow me to translate an entire log file at once.

Thanks

[SomeToast]

Analog will do this (and much more).

[absmiths]

Originally posted by dacreativeguy:
Can someone point me towards apps that perform reverse DNS lookups on raw web server log files?

I have a good command line utility to do this on Windows but haven't been able to find anything for the mac. There are a few that do one IP at a time, but I need one that will allow me to translate an entire log file at once.

Thanks

Well, dig can certainly do the trick - especially combined with a perl script:

Code:
[carulli:~] dig -x 17.254.0.91

; <<>> DiG 9.2.2 <<>> -x 17.254.0.91
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37285
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:
;91.0.254.17.in-addr.arpa.      IN      PTR

;; ANSWER SECTION:
91.0.254.17.in-addr.arpa. 86400 IN      PTR     www.apple.com.

;; AUTHORITY SECTION:
17.in-addr.arpa.        86400   IN      NS      nserver3.apple.com.
17.in-addr.arpa.        86400   IN      NS      nserver4.apple.com.
17.in-addr.arpa.        86400   IN      NS      nserver.asia.apple.com.
17.in-addr.arpa.        86400   IN      NS      nserver.euro.apple.com.
17.in-addr.arpa.        86400   IN      NS      nserver.apple.com.
17.in-addr.arpa.        86400   IN      NS      nserver2.apple.com.

;; ADDITIONAL SECTION:
nserver.asia.apple.com. 86400   IN      A       203.120.14.5
nserver.euro.apple.com. 86400   IN      A       17.72.133.64
nserver.apple.com.      432000  IN      A       17.254.0.50
nserver2.apple.com.     432000  IN      A       17.254.0.59
nserver3.apple.com.     432000  IN      A       17.112.144.50
nserver4.apple.com.     432000  IN      A       17.112.144.59

;; Query time: 81 msec
;; SERVER: 153.163.1.9#53(153.163.1.9)
;; WHEN: Mon Jan 19 12:21:29 2004
;; MSG SIZE  rcvd: 310

[carulli:~]

[dacreativeguy]

I tried analog, but couldn't get it to read my log file on my desktop. I haven't gone through all the documentation yet, but is there an easy way to get it to read a lot .txt file?

[SomeToast]

Originally posted by dacreativeguy:
I tried analog, but couldn't get it to read my log file on my desktop. I haven't gone through all the documentation yet, but is there an easy way to get it to read a lot .txt file?

Did you edit the Analog.cfg file to point to your log file? Find the LOGFILE directive and change it to:

LOGFILE "My Hard Disk:Users:myusername:Desktop:My Log.txt"

You'll also have to change "DNS NONE" to "DNS LOOKUP" if you want to resolve host names.

[andrew davidoff]

i'd suggest just writing a little perl script to grep out the domain names/ips, then just pass them to 'host'. unless you need something facy, that will do the trick and won't take long to whip up.

andrew davidoff

[dacreativeguy]

Thanks SomeToast. Those settings did the trick. I have Urchin on my web host for full web stats, so I just needed a quick tool to see who visited for the day. Thanks!

Originally posted by SomeToast:
Did you edit the Analog.cfg file to point to your log file? Find the LOGFILE directive and change it to:

LOGFILE "My Hard Disk:Users:myusernameesktop:My Log.txt"

You'll also have to change "DNS NONE" to "DNS LOOKUP" if you want to resolve host names.