I've just setup a squid proxy with sarge to monitor it. In the sarg report under UserID it lists the IP address of the machine that accessed the server. I'm using webmin to configure sarg and saw an option called "Resolve IP addresses?".

If I say "yes" to the option "Resolve IP addresses?" It changes 172.0.0.1 to localhost , but does not change a "real" ip address to its hostname , just leaves it the ip address.

How do I fix this ?

Sounds like a general DNS problem. It could be that you have 127.0.0.1 mapped to localhost in /etc/hosts file, but don't have a valid /etc/resolv.conf.

What is the result if you try to do some resolution using nslookup? Keep in mind also that IP-to-hostname resolution requires that reverse DNS is set up for the IP address; not all IPs have a PTR record in a reverse lookup zone.

Hi Wynand,
I think you are saying about Reporting in username basis.It is possible by confirming the entry "user_ip no" in /etc/sarg/sarg.conf
May it help.

Thanks for your responses.

I've checked my host file and it looks like this

search domain.com
nameserver 192.168.10.2

Looks ok to me.

I've got this entry.

An other problem thats showing up is that I've also got a Windows 2003 Terminal server in the network and at the moment sarg only shows the usage from my terminal servers IP address. If sarge could show usernames (if possible to get it from active dir that would be great ) it would help a lot.

We are also using a dhcp server in the network so having sarg only showing lots of IP addresses is not too useful.