[analog-help] Full IP Not Displayed

[Aengus]

On Tuesday, November 07, 2006 6:40 AM [EDT],
Jim Layton <jim at mail.wscafm.org> wrote:

> How about showing all the IP's in the "other" stat? Right now it shows
> about 4 and then a considerable block of "other".

The Organization report is designed to show the companies or organizations 
that users come from, and is most useful when you are doing DNS resolution. 
It will group users from xyz.london.example.com, pqr.dublin.example.com and 
abc.newyork.example.com all under the example.com "organization". When it is 
working with unresolved IP addresses, it has to assume that all IP addresses 
in the same Class A, B or C network are in a single Organization (so it will 
show 12.*.*.* as a single address, 136.17.*.* and 136.18.*.* as 2 different 
organizations and 201.201.201.* and 201.201.202.* as seperate 
organizations).

You can force it to show a bit more of the address by using the SUBORG 
command, but you're not going to get very satisfactory results from the 
Organization report if you're not using DNS resolution or some sort of 
HOSTAIASing.

> Is there a good breakdown of all available additions/options to the
> analog.cfg file where I could read up for myself and not have to
> bother the list?

The list doesn't mind being bothered. The documentation for Analog is 
extensive, (http://analog.cx/docs/) but to get the most out of the docs you 
will probably have to ask questions of the list. (For example, you will 
probably want to look at the FLOOR and SUBFLOOR settings if you need to drll 
all the way down in your Organization report. Just reading the documentation 
for the Organization report mightn't make that obvious).

Aengus