I have a scheduled bandwidth report that runs weekly. I have the profile configured to lookup IP numbers. One one item being reported, it is a false bad PTR that is showing meaning, meaning that the name being displayed does not really exist. How can I find out within Sawmill what that IP address is?
1. "RE: Find IP for a PTR in report."
In response to message #0
What log format are you processing? And what exactly is the value of the "false" hostname that Sawmill is displaying?
Once you have configured a profile to do reverse DNS lookup, you can no longer retrieve the IP address in the reports. You can select the "bad" value, zoom to the log detail report and then copy the timestamp of the event. This can then be used to search the raw log data for the IP.
Printer-friendly copy
