LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 08-18-2007, 07:05 AM   #1
rs15
LQ Newbie
 
Registered: Aug 2007
Posts: 8

Rep: Reputation: 0
convert LAN IP address to Host Name when I give cmd tail -f /var/log/squid/access.log


I am using Fedora 4. I have configured squid as a proxy server for my official LAN. When I monitor the log I want the local IP's hostname when it sends http request to proxy server.How can I convert LAN IP address to Host Name when I give command
tail -f /var/log/squid/access.log?
 
Old 08-19-2007, 02:40 AM   #2
rtg
Member
 
Registered: Aug 2005
Location: Ukraine
Distribution: Ubuntu 9.04
Posts: 99
Blog Entries: 3

Rep: Reputation: 19
Code:
#!/usr/bin/perl

use strict;
use IO::File;
use Fcntl qw(:seek);
use Socket;

my $fh = IO::File->new('/var/log/squid/access.log');

my $line;
while(1) {
    $fh->seek(0,1); 
    $line = $fh->getline();
    if ($line) {
        chomp $line;
        my (@fields) = split(' ', $line); 
        my $addr = $fields[2];
        my $name = gethostbyaddr(inet_aton($addr), AF_INET);
        if ($name) {
            $fields[2] = $name;
        }
        print join(' ', @fields), "\n";
    }
}
simple tail -f in perl with resolver requests

Have fun
 
Old 08-19-2007, 02:46 AM   #3
rtg
Member
 
Registered: Aug 2005
Location: Ukraine
Distribution: Ubuntu 9.04
Posts: 99
Blog Entries: 3

Rep: Reputation: 19
Code:
use strict;
use IO::File;
use Fcntl qw(:seek);
use Socket;

my $fh = IO::File->new('/var/log/squid/access.log');

my $line;
while(1) {
    $fh->seek(0,1); 
    $line = $fh->getline();
    if ($line) {
        chomp $line;
        my (@fields) = split(' ', $line); 
        my $addr = $fields[2];
        my $name = gethostbyaddr(inet_aton($addr), AF_INET);
        if ($name) {
            $fields[2] = $name;
        }
        print join(' ', @fields), "\n";
    } 
    else {  
        sleep 1;
    }
}
I've added sleep call because the previous version eats 100% CPU
 
Old 08-19-2007, 05:41 AM   #4
rs15
LQ Newbie
 
Registered: Aug 2007
Posts: 8

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by rtg View Post
Code:
use strict;
use IO::File;
use Fcntl qw(:seek);
use Socket;

my $fh = IO::File->new('/var/log/squid/access.log');

my $line;
while(1) {
    $fh->seek(0,1); 
    $line = $fh->getline();
    if ($line) {
        chomp $line;
        my (@fields) = split(' ', $line); 
        my $addr = $fields[2];
        my $name = gethostbyaddr(inet_aton($addr), AF_INET);
        if ($name) {
            $fields[2] = $name;
        }
        print join(' ', @fields), "\n";
    } 
    else {  
        sleep 1;
    }
}
I've added sleep call because the previous version eats 100% CPU
Thank you very much for your quick reply. But there are too many things in /usr/lib/perl. How and where should I insert this code? For your kind information I am very new linux environment.

Regards
rs15
 
Old 08-19-2007, 09:20 AM   #5
rtg
Member
 
Registered: Aug 2005
Location: Ukraine
Distribution: Ubuntu 9.04
Posts: 99
Blog Entries: 3

Rep: Reputation: 19
Ah, no, you should not put the script to the perl lib path.

Just save it as a file in your home directory (say squid-tail.pl) , then add
Code:
#!/usr/bin/perl
to the beginning of the script.

Change the rights to be 0755 -
Code:
chmod 0755 squid-tail.pl
and just run it under the user that has access to /var/log/squid:

./squid-tail.pl

or

perl squid-tail.pl -the script will start printing out all the lines from the log trying to resolve the ip addresses.

Feel free to ask if something is not quite clear.
 
Old 08-20-2007, 02:46 AM   #6
rs15
LQ Newbie
 
Registered: Aug 2007
Posts: 8

Original Poster
Rep: Reputation: 0
yeh...., I have done the job, at last. Thanks a lot. It shows the hostname instead of IP. But when I put the command perl squid-tail.pl, it executes the whole access.log file. Is it possible to show only desired part or latest part of access.log.

Regards
RS15
 
Old 01-22-2012, 01:45 AM   #7
aq_mishu
Member
 
Registered: Sep 2005
Location: Bangladesh
Distribution: RH 7.2, 8, 9, Fedora
Posts: 210

Rep: Reputation: 30
Now a little help please

guys,
Thanks for code. That is fantastic. But here are the two things...

How much resource it will actually take?? I have a Local DNS and resolving is damn fast infact. using this, using Vyatta Squid and SARG, i can track my hosts (300 of them) easily. But again, as it is a continuously running script with a forever while loop, how can i put it integrated so that it will do the lookup on a controlled manner, like a cron job, as first it will be executed then the "sarg-reports daily" in hour basis. This way, I dont want to keep it running for ever and to run it just when i'm making the log analysis.

I call this an another way to save resource.

I'm running centos 5.7 on a esxi 4.1

Mishu~
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Squid: not to log access by a particular host retiem Linux - Software 2 06-15-2012 05:44 PM
Howto tail -f /var/log/messages | grep isdninfo Mopp Programming 4 07-22-2011 10:00 AM
Access to /var/log/messages roniagmon Linux - Software 4 03-19-2006 01:55 AM
Strange results in /var/log/apache/access.log subt13 Linux - Security 2 08-03-2004 01:21 PM
My squid won't fill /var/log/squid/access.log linuxlah Linux - General 5 10-06-2003 10:51 PM


All times are GMT -5. The time now is 11:31 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration