title: Analyze log file of dnsmasq
body: <p>I current facing a problem. When I open the dnsmasq log, it looks like this:</p>
  
  <pre><code>Jun 10 17:50:00 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160
  Jun 10 17:50:00 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4
  Jun 10 17:50:21 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160
  Jun 10 17:50:21 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4
  Jun 10 17:50:31 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160
  Jun 10 17:50:31 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4
  Jun 10 17:50:37 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160
  Jun 10 17:50:37 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4
  Jun 10 17:50:40 dnsmasq[21796]: query[A] zyx.qq.com from 115.34.22.160
  Jun 10 17:50:40 dnsmasq[21796]: forwarded zyx.qq.com to 114.114.114.114
  Jun 10 17:50:40 dnsmasq[21796]: forwarded zyx.qq.com to 223.5.5.5
  Jun 10 17:50:40 dnsmasq[21796]: reply zyx.qq.com is 123.151.43.51
  Jun 10 17:50:40 dnsmasq[21796]: reply zyx.qq.com is 183.60.62.158
  Jun 10 17:50:40 dnsmasq[21796]: reply zyx.qq.com is 113.108.1.90
  Jun 10 17:50:42 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160
  Jun 10 17:50:42 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4
  Jun 10 17:50:52 dnsmasq[21796]: query[A] isatap.lan from 115.34.22.160
  Jun 10 17:50:52 dnsmasq[21796]: cached isatap.lan is NXDOMAIN-IPv4
  Jun 10 17:50:58 dnsmasq[21796]: query[A] ic.wps.cn from 115.34.22.160
  AND ETC.
  </code></pre>
  
  <p>It's very difficult for us to analyze it. Anybody have a idea to only show the queried domain which should be like this?</p>
  
  <pre><code>isatap.lan
  zyx.qq.com
  ic.wps.cn
  AND ETC.
  </code></pre>
  
  <p>However I tried this:
  <a href="http://www.tannerwilliamson.com/analyzing-dnsmasq-log-with-awk/1610/" rel="nofollow">http://www.tannerwilliamson.com/analyzing-dnsmasq-log-with-awk/1610/</a></p>
  
  <p>and its output i like this:</p>
  
  <pre><code>root@VM-208-178-ubuntu:/home# awk -f /home/dnsmasq.awk /var/log/dnsmasq.log | less
                                       name |      nb    |  forwarded |  answered from cache
                                  irs01.net |         1  |         1  |         0
   927662-0-2081296634-261190004.ns.124-14-16-250-ns.dns-spider.ffdns.net |         1  |         1  |         0
                           blog.sina.com.cn |         4  |         4  |         1
   927655-0-2081296634-261190004.ns.124-14-16-250-ns.dns-spider.myxns.cn |         1  |         1  |         0
                              www.baidu.com |         2  |         2  |         0
  *               careers.stackoverflow.com |        10  |        13  |         0
                  blender.stackexchange.com |         2  |         2  |         0
   974449-0-2081296634-261190004.ns.124-14-16-250-ns.dns-spider.myxns.cn |         1  |         1  |         0
                        img.iknow.bdimg.com |         2  |         1  |         1
  *                           smarterer.com |         2  |         3  |         0
                            a.disquscdn.com |         1  |         1  |         0
   927648-0-2081296634-261190004.ns.124-14-16-250-ns.dns-spider.myxns.cn |         1  |         1  |         0
                  physics.stackexchange.com |         6  |         5  |         4
  *                area51.stackexchange.com |         2  |         3  |         0
                    iknow02.bosstatic.bdimg.com |         2  |         1  |         1
                         passport.baidu.com |         1  |         1  |         0
                      webapps.stackexchange.com |         5  |         4  |         4
  </code></pre>
  
  <p>It's little bit different from what I want. Anybody could help me?
  Thanks for the help!</p>