How to get country code/name in the tail command result?
0
votes
2
answers
2149
views
I have asked this question about filtering out a LOG file
The LOG file is :
Jan 26 01:05:47 server54 kernel: [41s58.6w4335] INPUT:DROP: IN=eth4 OUT= MAC=d3:ss:43:23:23:43 SRC=1.1.1.1 DST=127.0.0.0 LEN=40 TOS=0x00 PREC=0x00 TTL=254 ID=65259 PROTO=TCP SPT=53252 DPT=22 WINDOW=14600 RES=0x00 RST URGP=0
The command is :
tail -f -n 2 /var/log/kern.log | grep 'INPUT' \
| sed -E 's/^([0-9a-zA-Z: ]*[0-9]{2}:[0-9]{2}:[0-9]{2}).* \
(SRC=[0-9.:]+).*(DST=[0-9.:]+).*$/\1 \2 \3/g'
and the output is :
Jan 26 01:05:47 SRC=1.1.1.1 DST=127.0.0.0
Now I need to feed the result to
whois
command to get the country(Name or Code) of Source IP address(SRC=) and it would give me a result like this :
Jan 26 01:05:47 SRC=1.1.1.1(US) DST=127.0.0.0(GH)
I just wonder if there is such a capability in that command(tail
) or bash script to goes into two direction , I mean, After printing out the filtered LOG, it get the source ip address by another sed and remove the SRC= :
sed -E 's/^.*(SRC=[0-9.:]+).*$/\1/g'| \
sed -e 's/SRC=//g' | whois ?!!!
and then feed it to whois
command and return and add it it to printing result.
Or i have to go to another approach because after each pipe the previous result is gone.
Asked by malloc
(135 rep)
Jan 3, 2020, 08:01 AM
Last activity: Jan 3, 2020, 10:39 AM
Last activity: Jan 3, 2020, 10:39 AM