Re: Usage Report show IP addr instead of computer names

Hello Oscar,

Thank you for kind update and sorry for my misunderstanding.

The reverse DNS look-up is only query DNS server, it has non relationship
with whether the client computer turn on.

You can confirm whether the DNS server can reverse DNS look-up individual
IP from the following 2 method:

Method 1:
1. Click Start on SBS, click Run, type "dnsmgmt.msc" and click OK.

2. Expand your server\Reverse Lookup Zones\<your local subnet>.Subnet.

3. Can you see the PTR record for the unresolved IP address, if not, please
add a PTR record for this IP address.

Pointer (PTR) - For mapping a reverse DNS domain name based on the IP
address of a computer that points to the forward DNS domain name of that
computer.

PTR records are used to support the reverse lookup process, based on zones
created and rooted in the in-addr.arpa domain. These records are used to
locate a computer by its IP address and resolve this information to the DNS
domain name for that computer.

PTR RRs can be added to a zone in several ways:

- You can manually create a PTR RR for a static TCP/IP client computer
using the DNS, either as a separate procedure or as part of the procedure
for creating an A RR.

- Computers use the DHCP Client service to dynamically register and update
their PTR RR in DNS when an IP configuration change occurs.

- All other DHCP-enabled client computers can have their PTR RRs registered
and updated by the DHCP server if they obtain their IP lease from a
qualified server. The Windows 2000 and Windows Server 2003 DHCP Server
service provides this capability.

The pointer (PTR) resource record is used only in reverse lookup zones to
support reverse lookup.

Example:
2.16.168.192.in-addr.arpa PTR sbs2k3pre.woody.local

Method 2:
1. On SBS, run nslookup command in command line

2. Then input the unresolved IP address, press Enter

3. Can you get the computer name of this IP?

Please also perform the following steps to make DNS can update PTR record
automatic:

In dnsmgmt, right-click <your local subnet>.Subnet and click Properties. On
General tab, in "Dynamic updates" please select "Nonsecure and secure".
Click Aging button, do not tick "Scavenge stale resource records".

Then monitor for one day (waiting for auto update).

If the issue persists, please kindly help me collect some information for
further investigation:

Save the application event log and system event log as evt files on the
problematic machines and send to my mailbox: v-terliu@xxxxxxxxxxxxx

Hope these steps will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| From: "OscarVogel" <rtk@xxxxxxxxxxxxxxx>
| References: <e6OGIL2MHHA.4244@xxxxxxxxxxxxxxxxxxxx>
<Avk#oK9MHHA.2304@xxxxxxxxxxxxxxxxxxxxxx>
| In-Reply-To: <Avk#oK9MHHA.2304@xxxxxxxxxxxxxxxxxxxxxx>
| Subject: Re: Usage Report show IP addr instead of computer names
| Date: Tue, 9 Jan 2007 09:35:32 -0600
| Lines: 157
| MIME-Version: 1.0
| Content-Type: text/plain;
| format=flowed;
| charset="iso-8859-1";
| reply-type=original
| Content-Transfer-Encoding: 7bit
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Windows Mail 6.0.5600.16384
| X-MimeOLE: Produced By Microsoft MimeOLE V6.0.5600.16384
| Message-ID: <OtSPPPANHHA.992@xxxxxxxxxxxxxxxxxxxx>
| Newsgroups: microsoft.public.windows.server.sbs
| NNTP-Posting-Host: 64-218-129-138.ded.swbell.net 64.218.129.138
| Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:9125
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Thanks for the quick response. Your answer is very helpful. You HAVE
| misunderstood a part of the problem, or more likely I wasn't clear. It
may
| be incidental, but first, I want to clarify 2 things;
|
| A) I want the computer names, NOT the IP addresses to appear in the Usage
| Report.
| B) I'm using SBS 2003 STANDARD edition which doesn't include ISA.
|
| But as I said, your answer is very helpful.
|
| Question; If the computer workstation computer is turned off when SBS
does
| the reverse lookups at 4:30, will that cause the Usage Report to identify
| that computer by its IP address instead of its computer name?
|
| That would explain a lot. But it would mean that the Usage Report would
not
| be very helpful unless everyone kept their computers turned on all night.
|
| Do I understand the situation correctly?
|
|
| "Terence Liu [MSFT]" <v-terliu@xxxxxxxxxxxxxxxxxxxx> wrote in message
| news:Avk%23oK9MHHA.2304@xxxxxxxxxxxxxxxxxxxxxxxxx
| > Hello Oscar,
| >
| > Thanks for posting here.
| >
| > I understand that in the Server Usage Report, you want to IP addresses
| > instead of computer names are listed under the heading of "Web Activity
by
| > Computer". If I have misunderstood the problem, please don't hesitate to
| > let me know.
| >
| > First, I want to explain How the Server Usage Report work:
| >
| > The Weblogging service receives IP address of the source and destination
| > from ISA/RAS of every Internet connection. It saves the IP addresses and
| > time stamp in the WebEvt.log file in "%windows%\temp". When the
scheduled
| > report time (by default it's 4:30 AM every day) comes, a reverse DNS
look
| > up is done to the source IP address to find the name of the machine. A
| > entry contains the source IP, destination IP, source machine name (if
| > available through reverse DNS look-up) and time of the connection will
be
| > added to the MSDE database, then the webevt.log is deleted. If the
reverse
| > DNS look up is successful, the machine name will show in the usage
report,
| > otherwise the IP address will show. The IP address is always in the
| > database.
| >
| > You may check if there are RPT records for those IP addresses in the
| > reverse lookup zone. To do so:
| >
| > 1. Click Start, click Run, type "dnsmgmt.msc" and click OK.
| >
| > 2. Expand your server\Reverse Lookup Zones\<your local subnet>.Subnet.
| >
| > If the IP address list in the Reverse Lookup Zones, the IP address will
be
| > resolved to computer name, and it will be listed as computer name
instead
| > of IP address in the Server Usage Report. If there is no IP address
list
| > in
| > the Reverse Lookup Zones, it can not be resolved to computer name, so it
| > will appear as IP only.
| >
| > Per my knowledge, we can not configure the Server Usage Report to only
| > list
| > IP address but not computer names in Server Usage Report. I will do some
| > further research and discuss with others about it.
| >
| > Hope info above helps.
| >
| > Please feel free to let me know if you have any questions or if you need
| > further assistance.
| >
| > I'm looking forward to hearing from you.
| >
| > Have a nice day!
| >
| > Best regards,
| >
| > Terence Liu(MSFT)
| >
| > Microsoft CSS Online Newsgroup Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| > =====================================================
| > This newsgroup only focuses on SBS technical issues. If you have issues
| > regarding other Microsoft products, you'd better post in the
corresponding
| > newsgroups so that they can be resolved in an efficient and timely
manner.
| > You can locate the newsgroup here:
| > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
| >
| > When opening a new thread via the web interface, we recommend you check
| > the
| > "Notify me of replies" box to receive e-mail notifications when there
are
| > any updates in your thread. When responding to posts via your
newsreader,
| > please "Reply to Group" so that others may learn and benefit from your
| > issue.
| >
| > Microsoft engineers can only focus on one issue per thread. Although we
| > provide other information for your reference, we recommend you post
| > different incidents in different threads to keep the thread clean. In
| > doing
| > so, it will ensure your issues are resolved in a timely manner.
| >
| > For urgent issues, you may want to contact Microsoft CSS directly.
Please
| > check http://support.microsoft.com for regional support phone numbers.
| >
| > Any input or comments in this thread are highly appreciated.
| > =====================================================
| >
| > This posting is provided "AS IS" with no warranties, and confers no
| > rights.
| >
| > --------------------
| > | From: "OscarVogel" <rtk@xxxxxxxxxxxxxxx>
| > | Subject: Usage Report show IP addr instead of computer names
| > | Date: Mon, 8 Jan 2007 14:22:53 -0600
| > | Lines: 15
| > | MIME-Version: 1.0
| > | Content-Type: text/plain;
| > | format=flowed;
| > | charset="iso-8859-1";
| > | reply-type=original
| > | Content-Transfer-Encoding: 7bit
| > | X-Priority: 3
| > | X-MSMail-Priority: Normal
| > | X-Newsreader: Microsoft Windows Mail 6.0.5600.16384
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.0.5600.16384
| > | Message-ID: <e6OGIL2MHHA.4244@xxxxxxxxxxxxxxxxxxxx>
| > | Newsgroups: microsoft.public.windows.server.sbs
| > | NNTP-Posting-Host: 64-218-129-138.ded.swbell.net 64.218.129.138
| > | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
| > | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:8940
| > | X-Tomcat-NG: microsoft.public.windows.server.sbs
| > |
| > | Using SBS 2003.
| > |
| > | "Server Usage Report" includes "Web Activity by Computer" which shows
| > total
| > | & avg active hours for each computer. In the "Computer Name" column
| > some
| > | computers are identified by their IP address. Others are identified
by
| > | their computer name. And some appear once as the IP address and
again
| > as
| > | the computer name.
| > |
| > | I'm guessing that they all should appear as their computer name. And
| > I'm
| > | also guessing that the IP addresses indicate some sort of name
| > resolution
| > | problem. Is that correct? If so, what might be the problem that's
| > causing
| > | some to be identified by their IP addresses?
| > |
| > | (From the SBS I AM able to resolve addresses to host names using "ping
| > -a").
| > |
| > |
| >
|
|

.