Stone Steps Inc.

Article ID: Q20041126-02

Q: How Stone Steps Webalizer handles DNS lookups?

A:Stone Steps redesigned the domain name resolution mechanism in Webalizer from the ground up. The original DNS lookup code used to parse each log file twice - once to resolve all IP addresses and the second time to analyze log file data. Starting from v2.1.10.6, Stone Steps Webalizer resolves IP addresses in one pass, while it is analyzing log file data.

Once an IP address is resolved to a name, the address and the name are stored on the hard drive in the DNS cache. The path to the DNS cache file is specified in the webalizer.conf file as follows:

DNSCache     c:\tools\webalizer\webalizer.dns

Stone Steps Webalizer uses Berkeley DB to implement the DNS cache, just as The Webalizer v2.1-10 does. However, Stone Steps Webalizer will only work with Berkeley DB v4.3.1 or newer.

By default, the domain name resolution mechanism is turned off for performance reasons. Use the -N command line argument to instruct Stone Steps Webalizer to perform DNS lookups:

webalizer -N 20 -p -F iis -n 127.0.0.1 -o reports logfiles\ex040924.log

The number following -N is the number of threads Stone Steps Webalizer will use to resolve IP addresses to domain names.

Each entry in the DNS cache is time-stamped and will be discarded after some time. The default time is set at three days and may be changed using the DNSCacheTTL configuration parameter. The value of this parameter is the number of days after which resolved domain names considered invalid. In most cases it is reasonable to increase this value to 30 days, as most ISP's do not change their domain names very often.

Starting from v2.1.10.7, Stone Steps Webalizer may be configured to re-resolve domain names that have been resolved earlier in the current month. When Stone Steps Webalizer is running in the persistent mode (using the -p switch), it stores all IP addresses and resolved domain names in the webalizer.current file. On each subsequent run during the same month, Stone Steps Webalizer reads this file and uses resolved domain names to update the associated counters (i.e. hit counts, etc).