On 3/28/01 2:03 PM Jeremy Wadsack ([EMAIL PROTECTED]) wrote:
>Sean Straw / PSE wrote:
>
>> I concur with this POV - Analog should NOT have a bunch of extra code
>> added to do rDNS. If anything, having Analog automatically invoke some
>> program with some options, specifying the logfile which Analog will be
>> running against, but before Analog opens it, might be a nice option (to
>> make the preprocessing basically transparent), but Analog itself should
>> still focus on the actual log analysis -- not resolving data that
>> perhaps should have been resolved by the webserver or by some other
>> program intended to handle that sort of thing.
>
>This seems like a good idea. If Analog had a DNSLOOKUP command similar
>to the UNCOMPRESS command, it would make it simpler to plug-in
>third-party rDNS tools. Since Analog's goal is to provide only basic DNS
>lookups, this would encourage the use of plug-in tools when needed.
This would slow things down dramatically, compared to running the
separate utility first, having it create a DNS cache file, and then
running Analog. One of the big advantages of the separate DNS cache file
is that it does not have to be in the same order as the log entries. When
Analog needs to do the lookup, it has to wait for an answer before
proceeding, but when DNSTran, or jdresolve, does the lookup it can queue
them up and then output them in any order. This allows a dramatic time
savings.
The best we could hope for, would be for Analog to have a setting that
told Analog to run the separate utility, wait for it to exit, and then do
it's own processing. Of course that is just a two line shell script, so
there isn't that much point in supporting that.
The DNS cache file is a flat sequential file, but it gets loaded into
memory only once, where it becomes an optimized hash table. Keeping file
formats simple is a big advantage, but Analog doesn't let that constrain
what it does internally.
Jason
-----------------
[EMAIL PROTECTED]
-----------------
Dr. Seuss books . . . can be read and enjoyed on several levels. For
example, 'One Fish Two Fish, Red Fish Blue Fish' can be deconstructed
as a searing indictment of the narrow-minded binary counting system.
-- Peter van der Linden, Expert C Programming, Deep C Secrets
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, go to
http://lists.isite.net/listgate/analog-help/unsubscribe.html
List archives are available at
http://www.mail-archive.com/[email protected]/
and
http://lists.isite.net/listgate/analog-help/archives/
------------------------------------------------------------------------
