- Introduction to Logging in Apache
- Default Apache Log Files
- Creating Log Formats
- Creating a Custom Log File
- Redirecting Logs to an External Program
- Logging Requests Conditionally
- Monitoring Who Is Linking to Your Website
- Monitoring Apache with mod_status
- Monitoring Apache with SNMP
- Analyzing Your Logs with Open-source Tools
- Monitoring Your Logs in Real Time
- Logging Requests to a Database
- Rotating and Archiving Logs
- Controlling IP Address Resolution
- Processing Logged IP Addresses
- Restarting Apache Automatically If It Fails
- Merging and Splitting Log Files
- Keeping Separate Logs for Each Virtual Host
- Common Log Entries
This chapter is from the book
This chapter is from the book
This chapter is from the book
Processing Logged IP Addresses
$ logresolve < access_log > resolved_log
Setting HostNameLookups to on can have an impact on the server's performance, slowing its response time. To avoid using this directive setting, it is possible to disable name resolution and use a separate post-processing utility that can scan the log files and replace the IP addresses with host names. These tools are more efficient because they can cache results and they do not cause any delay when serving requests to clients.
Apache includes one such tool, logresolve (logresolve.exe in Windows). It reads log entries from standard input and outputs the result to its standard output. To read to and from a file, you can use redirection, on both Unix and Windows, as shown in the example.
You should bear in mind that the result of an IP address resolution result will not always correspond to the real hostname that sent the request. For example, if there is a proxy or gateway between the client and the web server, the IP address reported by HostNameLookups or logresolve will be the IP address of the proxy or gateway and you will get the hostname of the proxy server or the IP block managed by the gateway, rather than the name of an actual host.