Cost of logging IP address for user activity

Question

If I were to log user IP addresses for each function he/she performs would that slow up the application in any way? For example I might log the last sign-in IP, and because the IP address will be overwritten on next login, I would have to log the IP again in a separate table where he/she posts a message, and again for another site function. Or should I keep a table of the last several IP logins for each user and calculate from there?

Answer 1

Are you already doing logging, and would you simply be adding the IP address in to your existing log entries? If so, this wouldn't make a major impact. It's resolving IP addresses to names that would make a performance impact.

Answer 2

Naturally adding more logging will always mean more writes to a database or log file, and that will slow things down.

The real question is what you want to use this for. Presumably it's not just about tracking who posted a message, etc. -- you clearly are using some kind of authentication, so presumably you know who posted the message. What are you using IP address for?

Answer 3

If you're trying to establish a history of what the user does then this is probably not a bad way to go about it. The cost depends on the cost of looking up the IP (probably trivial if it is a web application as that information is already known) and of writing a log to the database. Unless you're using some sort of nifty AJAX then simply logging page views is probably sufficient.

Answer 4

Answering the question, I'd say that, no, including the IP address in your logging, wouldn't slow down or add any additional cost to the logging mechanism. Presuming you're already logging things like:

• datetime
• URLs accessed
• screen res/OS/browser

The bigger question that's raised is: how often should you log the visit?

• every pageload?
• every IP address change?

Imagine you're on a website both on your PC and a mobile device. Forget the specifics really, imagine you've got two different sessions.

I'd say it's back to the business rules or needs.

Answer 5

So to directly answer your question, yes, adding any logging step will be slower than not having logged anything. However, for the most part it is a inconsequential cost. I suggest creating a user log table or log file that you only append to. That way your application can just insert into the table without having to process an update statement. You can always just clean out old data in a separate process as you see fit.

Answer 6

Perhaps using MDC for that purpose would reduce number of times you seek the IP address at different places in the code. Or even better, stick session ID into MDC and then follow that particular session, it's always easy to find out which IP the session corresponds to.