> > -> My log files are between 500,000 and 1,000,000 lines per day
> > file (mine grew to 11 M Bytes after just 2 weeks worth of logs...) is
> the
>
> Correct me if I'm wrong, but assuming your log file was 1 Gig at the end
> of a fortnight, that means that 99.9% of your logfile-ip addresses are
> covered in that DNS cache. This was calculated assuming minimum of
> of 500,000 lines per day, and a line size of 150 bytes (this was taken
> from an
> average figure of 180 bytes from a standard Apache logfile of 303671
> lines).
>
Probably closer to 98 - 99 % yes. But it still takes 3 - 4
hours to process a log file because the wait for unresolvable addresses.
The ones that resolve are not too much of a problem. If I have DNS NONE or
rerun then it takes less than 5 minutes to do the analysis.
This is just for one of 5 web servers so it does become an
issue and if HOSTALIAS processing was run before and after the DNS lookup
then I estimate that I would be well within the hour for each initial run
and improving as I enter more HOSTALIAS lines.
As Aengus said " I suggest that you're not in a position to advise
anyone on how DNS
should be handled with Analog." and I agree I am no expert but you have
to admit that if I am doing the work setting up these HOSTALIAS lines to get
more detailed org/domain reports then why not reuse the effort.
Perhaps I have stumbled unwittingly into an area where only experts
are welcome.....
Regards Jamie
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
+------------------------------------------------------------------------
