1 /* Licensed to the Apache Software Foundation (ASF) under one or more
2 * contributor license agreements. See the NOTICE file distributed with
3 * this work for additional information regarding copyright ownership.
4 * The ASF licenses this file to You under the Apache License, Version 2.0
5 * (the "License"); you may not use this file except in compliance with
6 * the License. You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
20 * Tom Rathborne - tomr uunet.ca - http://www.uunet.ca/~tomr/
21 * UUNET Canada, April 16, 1995
23 * Rewritten by David Robinson. (drtr ast.cam.ac.uk)
24 * Rewritten again, and ported to APR by Colm MacCarthaigh
26 * Usage: logresolve [-s filename] [-c] < access_log > new_log
29 * -s filename name of a file to record statistics
30 * -c check the DNS for a matching A record for the host.
32 * Notes: (For historical interest)
34 * To generate meaningful statistics from an HTTPD log file, it's good
35 * to have the domain name of each machine that accessed your site, but
36 * doing this on the fly can slow HTTPD down.
38 * Compiling NCSA HTTPD with the -DMINIMAL_DNS flag turns IP#->hostname
39 * resolution off. Before running your stats program, just run your log
40 * file through this program (logresolve) and all of your IP numbers will
41 * be resolved into hostnames (where possible).
43 * logresolve takes an HTTPD access log (in the COMMON log file format,
44 * or any other format that has the IP number/domain name as the first
45 * field for that matter), and outputs the same file with all of the
46 * domain names looked up. Where no domain name can be found, the IP
49 * To minimize impact on your nameserver, logresolve has its very own
50 * internal hash-table cache. This means that each IP number will only
51 * be looked up the first time it is found in the log file.
53 * The -c option causes logresolve to apply the same check as httpd
54 * compiled with -DMAXIMUM_DNS; after finding the hostname from the IP
55 * address, it looks up the IP addresses for the hostname and checks
56 * that one of these matches the original address.
62 #include "apr_getopt.h"
63 #include "apr_strings.h"
64 #include "apr_file_io.h"
65 #include "apr_network_io.h"
71 #define LINE_BUF_SIZE 2048
73 static apr_file_t *errfile;
74 static const char *shortname = "logresolve";
75 static apr_hash_t *cache;
78 static int cachehits = 0;
79 static int cachesize = 0;
80 static int entries = 0;
81 static int resolves = 0;
82 static int withname = 0;
83 static int doublefailed = 0;
84 static int noreverse = 0;
87 * prints various statistics to output
89 #define NL APR_EOL_STR
90 static void print_statistics (apr_file_t *output)
92 apr_file_printf(output, "logresolve Statistics:" NL);
93 apr_file_printf(output, "Entries: %d" NL, entries);
94 apr_file_printf(output, " With name : %d" NL, withname);
95 apr_file_printf(output, " Resolves : %d" NL, resolves);
98 apr_file_printf(output, " - No reverse : %d" NL,
103 apr_file_printf(output, " - Double lookup failed : %d" NL,
107 apr_file_printf(output, "Cache hits : %d" NL, cachehits);
108 apr_file_printf(output, "Cache size : %d" NL, cachesize);
114 static void usage(void)
116 apr_file_printf(errfile,
117 "%s -- Resolve IP-addresses to hostnames in Apache log files." NL
118 "Usage: %s [-s STATFILE] [-c]" NL
121 " -s Record statistics to STATFILE when finished." NL
123 " -c Perform double lookups when resolving IP addresses." NL,
124 shortname, shortname);
129 int main(int argc, const char * const argv[])
131 apr_file_t * outfile;
133 apr_file_t * statsfile;
135 apr_sockaddr_t * ipdouble;
144 #if APR_MAJOR_VERSION > 1 || (APR_MAJOR_VERSION == 1 && APR_MINOR_VERSION >= 3)
148 char line[LINE_BUF_SIZE];
149 int doublelookups = 0;
151 if (apr_app_initialize(&argc, &argv, NULL) != APR_SUCCESS) {
154 atexit(apr_terminate);
157 shortname = apr_filepath_name_get(argv[0]);
160 if (apr_pool_create(&pool, NULL) != APR_SUCCESS) {
163 apr_file_open_stderr(&errfile, pool);
164 apr_getopt_init(&o, pool, argc, argv);
167 status = apr_getopt(o, "s:c", &opt, &arg);
168 if (status == APR_EOF) {
171 else if (status != APR_SUCCESS) {
186 stats = apr_pstrdup(pool, arg);
192 apr_file_open_stdout(&outfile, pool);
193 apr_file_open_stdin(&infile, pool);
195 #if APR_MAJOR_VERSION > 1 || (APR_MAJOR_VERSION == 1 && APR_MINOR_VERSION >= 3)
196 /* Allocate two new 10k file buffers */
197 if ((outbuffer = apr_palloc(pool, 10240)) == NULL ||
198 (inbuffer = apr_palloc(pool, 10240)) == NULL) {
202 /* Set the buffers */
203 apr_file_buffer_set(infile, inbuffer, 10240);
204 apr_file_buffer_set(outfile, outbuffer, 10240);
207 cache = apr_hash_make(pool);
209 while (apr_file_gets(line, sizeof(line), infile) == APR_SUCCESS) {
210 char dummy[] = " " APR_EOL_STR;
212 if (line[0] == '\0') {
216 /* Count our log entries */
219 /* Check if this could even be an IP address */
220 if (!apr_isxdigit(line[0]) && line[0] != ':') {
222 apr_file_puts(line, outfile);
226 /* Terminate the line at the next space */
227 if ((space = strchr(line, ' ')) != NULL) {
234 /* See if we have it in our cache */
235 hostname = (char *) apr_hash_get(cache, line, APR_HASH_KEY_STRING);
237 apr_file_printf(outfile, "%s %s", hostname, space + 1);
242 /* Parse the IP address */
243 status = apr_sockaddr_info_get(&ip, line, APR_UNSPEC ,0, 0, pool);
244 if (status != APR_SUCCESS) {
245 /* Not an IP address */
248 apr_file_puts(line, outfile);
252 /* This does not make much sense, but historically "resolves" means
253 * "parsed as an IP address". It does not mean we actually resolved
254 * the IP address into a hostname.
258 /* From here on our we cache each result, even if it was not
263 /* Try and perform a reverse lookup */
264 status = apr_getnameinfo(&hostname, ip, 0) != APR_SUCCESS;
265 if (status || hostname == NULL) {
266 /* Could not perform a reverse lookup */
268 apr_file_puts(line, outfile);
273 apr_hash_set(cache, line, APR_HASH_KEY_STRING,
274 apr_pstrdup(pool, line));
278 /* Perform a double lookup */
280 /* Do a forward lookup on our hostname, and see if that matches our
281 * original IP address.
283 status = apr_sockaddr_info_get(&ipdouble, hostname, ip->family, 0,
285 if (status == APR_SUCCESS ||
286 memcmp(ipdouble->ipaddr_ptr, ip->ipaddr_ptr, ip->ipaddr_len)) {
287 /* Double-lookup failed */
289 apr_file_puts(line, outfile);
294 apr_hash_set(cache, line, APR_HASH_KEY_STRING,
295 apr_pstrdup(pool, line));
300 /* Outout the resolved name */
301 apr_file_printf(outfile, "%s %s", hostname, space + 1);
303 /* Store it in the cache */
304 apr_hash_set(cache, line, APR_HASH_KEY_STRING,
305 apr_pstrdup(pool, hostname));
308 /* Flush any remaining output */
309 apr_file_flush(outfile);
312 if (apr_file_open(&statsfile, stats,
313 APR_FOPEN_WRITE | APR_FOPEN_CREATE | APR_FOPEN_TRUNCATE,
314 APR_OS_DEFAULT, pool) != APR_SUCCESS) {
315 apr_file_printf(errfile, "%s: Could not open %s for writing.",
319 print_statistics(statsfile);
320 apr_file_close(statsfile);