Provide a means for storing a history of DNS/Name changes for the IP Addresses extracted from web log files. The major target being that multiple analyses of older log files do not require re-lookups of IP Address to FQDNs, and additionally maintain the accuracy of the lookup as it was then and not as it is now.

Latest Production Release is version 1.3 dnshistory-1.3.tar.gz

Why DNSHistory?

Several reasons:

• Save on disk space! Estimates for one system I look after, shows that using DNSHistory vs dnstran, saves around 4Gb of disk space a year. Given the cost of high performance SCSI drives, that does translate into not insignificant dollars!
• Accuracy. dnstran has a distressing tendency to translate parts of logfiles that shouldn't be translated. Additionally, compared with "cache" style translators, you will get different results if you ever need to re-run in years to come.
• Accessible. DNSHistory can be pipelined with other tools. You're not tied to a single product to do log analysis. egrep, gawk and cut can do a lot of simple fast analysis.
• Fun!

Description

With versio 1.3, DNSHistory can also process squid, ftp xferlog and iptables log files.

dnshistory currently has five modes of operation:

• Do Lookups. The default mode. Given a web log file, dnshistory will perform DNS reverse lookups on each unique IP Address and store the results in a history database.
• Do Translations. Given a raw web log file, dnshistory will make use of a previously created history database and send to STDOUT the same web log but with addresses replaced by the Fully Qualified Domain Name as previously looked up.
• Do Recombining. Given two web log files, one raw and one previously translated (eg. by using dnstran): Create a history database from the values in these separate log files.
• Do Dump. Dump a given history database to STDOUT.
• Do Import. Import a previously dumped history into a new database.
• Show History. Given one or more IP Addresses on the command line, display their history from the database.

It's quite possible that most users would only ever use the first two modes.

The lookups make use of threads for near maximum speed, and use the standard resolution libraries on a system. Thus hosts files, NIS, LDAP and other name resolution methods should work transparently. Unfortunately most other tools ignore local name resolution methods in favour of DNS lookups only.