From de12ad5e5f817fd2c4f0de3dde29438ce832eefe Mon Sep 17 00:00:00 2001 From: Michael Orlitzky Date: Fri, 16 Sep 2022 15:13:39 -0400 Subject: [PATCH] bin/djbdns-logparse.py: improve existing decode_* docs. --- bin/djbdns-logparse.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/bin/djbdns-logparse.py b/bin/djbdns-logparse.py index 5262fe0..0abd5bc 100755 --- a/bin/djbdns-logparse.py +++ b/bin/djbdns-logparse.py @@ -125,6 +125,9 @@ def decode_client(words : list, i : int): 1. clientip:clientport, used by tcpopen/tcpclose entries, 2. clientip:clientport:id, used by "query" entries. + We convert each part from hex to decimal, and in the second + format, separate the packet id from the client information. + Parameters ---------- @@ -172,7 +175,7 @@ def decode_ip(words : list, i : int): entry. A single "serverip" field is present in the lame, nodata, - nxdomain, and rr entry types. + nxdomain, and rr entry types. We convert it from hex to decimal. Parameters ---------- @@ -202,7 +205,6 @@ def decode_ip(words : list, i : int): >>> decode_ip(words, 1) >>> words ['foo', '0000:0000:0000:0000:0000:ffff:7f00:0001', 'bar', 'quux'] - """ words[i] = convert_ip(words[i]) @@ -212,7 +214,8 @@ def decode_ttl(words : list, i : int): entry. A single "ttl" field is present in the nodata, nxdomain, and - rr entry types. + rr entry types. We prefix it with "TTL=" so that its meaning + is clear in the human-readable logs. Parameters ---------- -- 2.44.2