reslog Version 3.16
Author: imacat
Keywords: DNS look up, HostNameLookups, Apache, Analog, log files

正體中文 | 简体中文 | English

:::

# `reslog` Version 3.16

## What’s New?

2007-12-04

  `reslog` version 3.16 is released. This release fixed a bug with empty files created with `Compress::Bzip2`. Download `reslog` version 3.16.

2007-12-03

  `reslog` version 3.15 is released. Fixed the minimal required Perl version in the `Makefile.PL` installation. Upgrade is not necessary if you have installed `reslog` version 3.13 or later. Download `reslog` version 3.15.

2007-12-03

  `reslog` version 3.14 is released. There are several documentation and test suite fixes. Upgrade is not necessary if you have installed `reslog` version 3.13. Download `reslog` version 3.14.

2007-12-03

  `reslog` version 3.13 is released. There are many code enhancements, bug fixes, test suite enhancements and documentation fixes. Download `reslog` version 3.13.

2007-07-23

  `reslog` version 3.12 is released. Fixed the error when there is no IP to be resolved. Download `reslog` version 3.12.

2007-07-23

  `reslog` version 3.11 is released. Fixed problem with non-threaded Perl, fixed bug checking `STDIN` file type with the `file` program, moved files back to the Perl default installation directories, and added support for installation with `Module::Build`. Download `reslog` version 3.11.

2007-07-22

  `reslog` version 3.10 is released. Documentation fixes. Download `reslog` version 3.10.

2007-07-21

  `reslog` version 3.09 is released. License updated to GPLv3, and various fixes. Download `reslog` version 3.09.

2005-05-22

  `reslog` version 3.08 is released. Documentation fixes. Download `reslog` version 3.08.

2005-05-22

  `reslog` version 3.07 is released. Clean up the code so that it works on more platforms. Now it works on Linux, MS-Windows, Cygwin, Solaris, FreeBSD and MacOSX Darwin. Download `reslog` version 3.07.

2005-05-16

  `reslog` version 3.06 is released. Rewrite the test suite so that the result is more correct, accuate and meaningful. Download `reslog` version 3.06.

2005-05-08

  `reslog` version 3.05 is released. Fixed a bug that unavailable `STDIN` may cause error. Download `reslog` version 3.05.

2005-05-08

  `reslog` version 3.04 is released. Fixed a typo when loading `File::MMagic`. Download `reslog` version 3.04.

2005-05-08

  `reslog` version 3.03 is released. Default installation directory moved back to `/sbin`. `make upgrade` is added to remove files from the old versions. `flock()` policy is redesigned for consistency and less errors. Download `reslog` version 3.03.

2005-05-02

  `reslog` version 3.02 is released. Resolver is now independent from the main program. Successfully tested and run on MS-Windows and Cygwin. Several small bugs are solved. Download `reslog` version 3.02.

2005-04-26

  `reslog` version 3.01 is released. A serious bug that `--suffix` and `--trim-suffix` was obtaining wrong value is fixed. You should upgrade to version 3.01 immediately if you were using 3.00. Download `reslog` version 3.01.

2005-04-26

  `reslog` version 3.00 is released. I rewrote everything. The code is now object-oriented. ithreads Threading support is added so that it is really fast now. bzip2 compression is supported. Compressing and decompressing using `gzip` and `bzip2` executables without installing `Compress::Zlib` and `Compress::Bzip2` is now possible, although discouraged. Certain file name suffix can be removed before outputing the result file, so that it can be line-up with other log file filters. Download `reslog` version 3.00.

2002-09-18

  `reslog.pl` version 2.1.0dev2 is released. This release corrects several documentation errors. It also adds SourceForge in the documentations as one of the sources of `reslog.pl`. You can think of it as a Source Forge Memorial Release. :p You don’t have to upgrade to this version in a rush. Download `reslog.pl` version 2.1.0dev2.

2002-09-17

  `reslog.pl` is hosted at SourceForge now! Congratulations! (Although I’m still trying hard to get it working at this time… ^^; )

2002-08-31

  `reslog.pl` version 2.1.0dev1 is released. This release fixes the problem that it wouldn’t run with Perl 5.8.0. I marked it as dev because I wish I can implement `Compress::Bzip2` and `ExtUtils::MakeMaker` in the 2.1.0 stable release. But it is is in fact very stable. Download `reslog.pl` version 2.1.0dev1.

## Description

`reslog` reverse-resolves IP in the Apache log files. These log files can then be analyzed by another program, like Analog. You can think of it as a replacement of Apache `HostNameLookups` directive, in the sense that it resolves the client IP altogether once a day.

## Caution

- Resolving takes long time. This is mainly caused by resolving: Network packets may be filtered by firewalls; DNS servers may not be correctly configured; may not be up working; may sit in slow network sections; may be old slow machines; may have traffic jam… etc. All these reasons are out of our control.

- If it stops in the middle of its execution, as when the user hits a `Ctrl-Break`, it may leave a temporary working file. The next time it runs, it will stop when it sees that temporary working file at the first sight. Please process that file first. You can resolve it again, just like an ordinary log file.

- This prorgam needs temporary working space. Between memory and disk space, I choose disk space, since it is cheaper and may be available in more environments. However, this means that it needs free temporary disk space about 2 times of the size of the uncompressed source log log file (10 times if using memory). Please make sure you have that much free space.

- `reslog` does not support IPv6 yet.

- I suggest you to install `File::MMagic` instead of counting on the `file` executable. The internal magic file of `File::MMagic` seems to work better than the `file` executable. `reslog` treats everything not `gzip` nor `bzip2` compressed as plain text. When a compressed log file is wrongly recognized as an image, `reslog` will treat it as plain text, read log records directly from it and fail. This failure does not hurt the source log files, but is still annoying.

## System Requirement

1. Perl, version 5.8.0 or above. `reslog` uses 3-argument `open()` to duplicate filehandles, which is only supported since 5.8.0. I have not successfully port this onto earlier versions yet. Please tell me if you made it. You can run `perl -v` to see your current Perl version. If you don't have Perl, or if you have an older version of Perl, you can download and install/upgrade it from Perl website. If you are using MS-Windows, you can download and install ActiveState ActivePerl.

2. Required Perl modules: none.

3. Optional Perl modules:

   `File::MMagic`

     This is used to check the file type. If this is not available, `reslog` will look for the `file` executable instead. If that is not available, too, `reslog` will judge the file type by its name suffix (extension). In that case `reslog` will fail when reading from `STDIN`. ActivePerl MS-Windows users can install this using `ppm install File::MMagic`, or get `file.exe` from the GnuWin32 home page. Be sure to save it as `file.exe` somewhere in your `PATH`.

     I suggest you use `File::MMagic`. `file` executable seems to make mistakes occationally.

   `Compress::Zlib`

     This is used to support read/write of gzip compressed files. It is only needed when gzip compressed files are encountered. If it is not available when needed, `reslog` will try to use the `gzip` executable instead. If that is not available, too, `reslog` will fail. ActivePerl MS-Windows users can install this using `ppm install Compress::Zlib`, or get `gzip.exe` from the gzip home page. Be sure to save it as `gzip.exe` somewhere in your `PATH`.

   `Compress::Bzip2`, version 2 or above

     This is used to support read/write of bzip2 compressed files. It is only needed when bzip2 compressed files are encountered. If it is not available when needed, `reslog` will try to use the `bzip2` executable instead. If that is not available, too, `reslog` will fail. Notice that older versions before 2 does not work, since file I/O compression were not implemented yet. ActivePerl MS-Windows does not have `Compress::Bzip2` in their PPM deposit yet, as the time I’m writing this. You can get `bzip.exe` from the bzip home page instead. Be sure to save it as `bzip2.exe` somewhere in your `PATH`.

   `Term::ReadKey`

     This is used to display the progress bar. Without this `reslog` won’t display the progress bar, but nothing else is different. The progress bar is a good visual representation of what `reslog` is currently doing.

   You can always search, download and install the missing Perl modules from the the CPAN archive.

## Download

`reslog`’s official websites is at…

- `reslog` web site at SourceForge

- `reslog` project page at SourceForge

- `reslog` project page at CPAN

- `reslog` page at Tavern IMACAT’s

You can always download the newest version of `reslog` from…

- `reslog` download page at SourceForge

- `reslog`’s project page at CPAN

- Tavern IMACAT’s FTP directory

imacat’s PGP public key is at…

- imacat’s PGP key at `reslog` SourceForge web site

- imacat’s PGP key at Tavern IMACAT’s

## Install

If you are upgrading from `reslog` 3.10 or earlier, or if you are upgrading from `reslog.pl` 3.02 or earlier, please read `UPGRADE` for some upgrade instruction.

### Install with `ExtUtils::MakeMaker`

`reslog` uses standard Perl installation with `ExtUtils::MakeMaker`. Follow these steps:

>     % perl Makefile.PL
>     % make
>     % make test
>     % make install

When running `make install`, make sure you have the priviledge to write to the instalation location. This usually requires the `root` priviledge.

If you are using ActivePerl under MS-Windows, you should use `nmake` instead of `make`. `nmake` can be obtained from the Microsoft FTP site.

If you want to install into another location, you can set the `PREFIX`. For example, to install into your home when you are not `root`:

>     % perl Makefile.PL PREFIX=/home/jessica

Refer to the docuemntation of `ExtUtils::MakeMaker` for more installation options (by running `perldoc ExtUtils::MakeMaker`).

### Install with `Module::Build`

You can install with `Module::Build` instead, if you prefer. Follow these steps:

>     % perl Build.PL
>     % ./Build
>     % ./Build test
>     % ./Build install

When running `./Build install`, make sure you have the priviledge to write to the instalation location. This usually requires the `root` priviledge.

If you want to install into another location, you can set the `--prefix`. For example, to install into your home when you are not `root`:

>     % perl Build.PL --prefix=/home/jessica

Refer to the docuemntation of `Module::Build` for more installation options (by running `perldoc Module::Build`).

## Options

    ./reslog [options] [logfile…]
    ./reslog [-h|-v]

logfile

  The log file to be resolved. Multiple log files are supported. If not specified, it will read from `STDIN` and output to `STDOUT`. You can also specify `-` to read from `STDIN`. Result of `STDIN` will go to `STDOUT`. `gzip` or `bzip2` compressed files are supported, too.

-k, --keep mode

  What to keep in the source file. Currently the following modes are supported:

  a, all

    Keep the source file after records are archived.

  r, restart

    Restart the source file after records are resolved.

  d, delete

    Delete the source file after records are resolved. This is the default.

-o, --override mode

  Whether we should overwrite the existing resolved files. Currently the following modes are supported:

  o, overwrite

    Overwrite existing target files.

  a, append

    Append the records to existing target files.

  f, fail

    Stop processing whenever a target file exists, to prevent destroying existing files by accident. This is the default.

-s, --suffix suf

  The suffix to be appended to the output file. If not specified, the default is `.resolved`.

-t, --trim-suffix suf

  The suffix to be trimmed from the input file name before appending the above suffix. Default is none. If you are running several log file filters, this can help you trim the suffix of the previous one.

-n, --num-threads num

  Number of threads to run simultaneously. The default is 10. Use 0 to disable threading. Your system must support threading itself. This option has no effect for systems that do not support threading.

-c, --stdout

  Output the result to `STDOUT`.

-d, --debug

  Show the detailed debugging messages. More `-d` to be more detailed.

-q, --quiet

  Shihhhhhh. Only yell when errors.

-h, --help

  Display the help message and exit.

-v, --version

  Output version information and exit.

## Copyright

Copyright © 2001-2007 imacat.

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see `<http://www.gnu.org/licenses/>`.

## Release Notes

Please read the `Changes` for the new functions and bug fixes.

## Support

`reslog` is hosted on SourceForge, CPAN and Tavern IMACAT’s. For the latest infomation, see

- `reslog` web site at SourceForge.

- `reslog` project page at SourceForge.

- `reslog` project page at CPAN.

- `reslog` page at Tavern IMACAT’s.

There is a `reslog` mailing list hosted at SourceForge. Please submit your questions, suggestions or bug reports there. It is a Mailman mailing list. For more information, see the `reslog` mailing list page. Alternatively, you can send a mail to the e-mail command mailbox with the subject `help` for a list of available e-mail commands.