Actually, this is something I have thought about a lot recently- it
seems to me that it would be a nice feature to only include the top-level
domain, and then one more part...
For example, if you resolve a name to "statlab.cam.ac.uk" simply list it
as "ac.uk" - or maybe "cam.ac.uk" to cover things like ".co.uk" Maybe a
runtime thing, like "SIGDOMPARTS 3" which would give you three "dots
worth" of domain information from the top level. (cam.ac.uk in this case)
Personally I think it makes a lot more sense to put this option into
analog itself, rather than generating massive files that have to be read
in every time you start up a stats process. Never mind maintaining these
files- which would be a job in itself...
In fact, one other thing that I've thought about- how about when you do
a lookup, giving the option to cache the name based on just the class-C
part of the address and using it for future lookups...
For example, you resolve 207.239.68.10 to "trelane.addy.com". You cache
this name, and when you get a request from 207.239.68.9 you determine
that 207.239.68.* is "addy.com" and have done with it.
Of course this system isn't perfect since not all domains are broken up
along class C network boundaries, but it would speed things up somewhat
(DNS lookups longer than everything else analog does combined) and it's
close enough since I'd bet that most of those "oddball" sites don't
originate traffic anyway.
Anyone else think about this and find something I haven't?
-=Jim=- Addy & Associates
P.S. My "exhaustive" list of config options is coming along. I need to
check it for completeness and accuracy, but I should have that done
tomorrow probably, and will post it here.
--------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
--------------------------------------------------------------------
