httpd-analyse

The most horrid command to type in, but it will probably only be in makefiles anyway.

Standard input is an httpd log file.

Standard output is a version of the log file with the document name simplified if necessary, and the IP adderss turned into DNA name form if this is possible at the time.

Checking DNS for every line of a 300k line file rather hammers it and is not considered friendly by DNS administrators, so there are various ways to use a local hosts file. The hosts file may be read in, appended to, and/or output at the end. Note that the format is not the usual /etc/hosts file format!

Options

-a
Just look me up this IP address. Exits immediately after giving you the output.
-hi file
Use this hosts file as input. Many host files may be given with separate occurences of this option.
-ha file
Append to this host file. After all "-hi" host files have been read, this is read in. It is then opened for appen, and any new host names found are appended to it. The count fieldof this file is not valid, as future occurences of the same hostname will not be
-ho file
When all processing has been finished, the list of all hosts so far is dumped on this file. Thsi information includes a count of all accesses to each host.
-v
Verbose. print out progress (per 1000 lines), error messages, new hosts, etc. to stderr.
-vv
Very verbose. Explanations of DNS error messages are larger. Implies -v.

Host file format

Lines starting with "#" are ignored. Every other line has the following format:
ipaddress   status  count  name

where:
ipaddress
is a regular dot-separated-decimal address, like 128.141.201.74;
status
is zero if the name is good, else the h_errno value which defined what sort of a lookup problem there was
count
If -ho has been used, the number of times the host has been accessed is stored
name
is the DNS name of the host if known, else "?".
Tim BL