Sample Header Ad - 728x90

How to get country code/name in the tail command result?

0 votes
2 answers
2149 views
I have asked this question about filtering out a LOG file The LOG file is : Jan 26 01:05:47 server54 kernel: [41s58.6w4335] INPUT:DROP: IN=eth4 OUT= MAC=d3:ss:43:23:23:43 SRC=1.1.1.1 DST=127.0.0.0 LEN=40 TOS=0x00 PREC=0x00 TTL=254 ID=65259 PROTO=TCP SPT=53252 DPT=22 WINDOW=14600 RES=0x00 RST URGP=0 The command is : tail -f -n 2 /var/log/kern.log | grep 'INPUT' \ | sed -E 's/^([0-9a-zA-Z: ]*[0-9]{2}:[0-9]{2}:[0-9]{2}).* \ (SRC=[0-9.:]+).*(DST=[0-9.:]+).*$/\1 \2 \3/g' and the output is : Jan 26 01:05:47 SRC=1.1.1.1 DST=127.0.0.0 Now I need to feed the result to whois command to get the country(Name or Code) of Source IP address(SRC=) and it would give me a result like this : Jan 26 01:05:47 SRC=1.1.1.1(US) DST=127.0.0.0(GH) I just wonder if there is such a capability in that command(tail) or bash script to goes into two direction , I mean, After printing out the filtered LOG, it get the source ip address by another sed and remove the SRC= : sed -E 's/^.*(SRC=[0-9.:]+).*$/\1/g'| \ sed -e 's/SRC=//g' | whois ?!!! and then feed it to whois command and return and add it it to printing result. Or i have to go to another approach because after each pipe the previous result is gone.
Asked by malloc (135 rep)
Jan 3, 2020, 08:01 AM
Last activity: Jan 3, 2020, 10:39 AM