DNS Lookup with Analog

why o why won't it work?

[casualsub]

I'm using Analog to go thru my logs and I've hit big problems with DNS lookup. I know there are some *serious* Analog users here so perhaps you can help?

I'm working off-line so I have configured Analog as:

DNS READ
DNSFILE dnscache.txt

And I've used another tool (LookupIP from clasohm.com) to create dnscache.txt.

However, when I run Analog it refuses to use dnscache.txt, and my site report still contains only unresolved IP addresses. Any ideas? I tried running Analog with SETTINGS ON but this didn't show anything unexpected.

Finally if you can help with this (hey even if you can't) does anyone know, how/if it's possible, to specify IP ranges in the DNSFILE?

Many thanks in advance :)

[Macguru]

Hi casualsub,

Welcome to WmW, you just found the right place.

I am not sure Analog can use the dnscache file from another format. I suggest you set the analog.cfg file to DNS WRITE and make it create his own file while working online.

Just curious, did you try removing the .txt extension from the dnscache file?

[chiyo]

We are long time Analog users and use a tool from www.analogx.com to do parallel DNS look ups. full instructions, very clear and quick, on how to set up with analog. Havent downloaded a version for around 2 years.. hope its still there and free!

[bill]

odd this topic just came up...the analogx site just got updated the other day...first time in years. :) Their QuickDNS tool works just as well with Analog now as it always has. Very fast. Even Analog recommends the AnalogX QuickDNS tool over their own DNS WRITE, which can be really slow.

[casualsub]

Right - another day, so many new options to try. Thanks to all for the suggestions I'll let you how it works out.

[casualsub]

Right. I started with Macguru's suggestion and I think the problem is solved already. Thanks to everyone though.

Removing the txt extension from dnscache did nothing, but let's face it with a fix potentially that easy that was always where I was going to start.

What did work was running Analog on-line with DNS WRITE set. This took ages, over 13mins rather than 15secs, but worked. It also hightlighted what had been wrong previously. The dnscache file I had been using had completely incorrect timestamps. I figure this caused Analog to ignore all the entries it contained.

Now obviously Analog works reasonably quickly again (26secs), even with DNS WRITE set, as it is using the file I have already created. I will try the other tools suggested for DNS lookup though as I have still to run this on the whole set of (larger) log files I have available.

Finally, at the risk of starting an entire new thread, is it now possible for me to include IP ranges in my dnscache file? Do wildcards work? Help wanted, but I will experiment.

[Woz]

CasualSub,

I highly recommend you have a look at QuickDNS from AnalogX as this will speed things up tremendously. It may only be 13 minutes now, but, as your site grows and your logs grow............

Onya
Woz

[casualsub]

I feel like a complete newbie. I can't get Analogx QuickDNS to work now. I'm trying to run:

qdns /D mydns.txt /L mylog.log

With my full log this just seems to hang (I left it to run for approx 1hr on the last attempt), with a few lines of the log only (with IPs I would expect to resolve) it seemingly runs okay but doesn't resolve the addresses. What am I doing wrong? Do I need a /Y switch, and if so how do I find out the IP address of a DNS server?

[Woz]

CS,

use the DNS numbers supplied by your ISP.

Onya
Woz

[casualsub]

I don't know the ISP details as I'm within a large firewall'ed company network. I'm just going to use DNS WRITE instead (until the wait gets too frustrating).

Thanks to all for the help.

[bill]

If you're on a Windows box you can type:
ipconfig /all
into a command line and it should list your DNS servers...I too am firewalled and this trick came in handy trying to get QuickDNS working.

[casualsub]

bill,

You are my hero. That is perfect.

:)