Re: MaxMind GeoIP support in 3.0.8.2
Kevin Branch <[email protected]> Sat, 29 Sep 2018 11:56:36 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <CA+dGL9EeFKMxyTaWu44Eu3zJ1U7VUx9-eRm6R6K47gpHK4Wo1A@mail.gmail.com> |
--000000000000a08d8a0577049e45
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Hi Carter and David,
I just tried the following with the same ralabel.conf as before:
ra -r /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s
label:200 -N20
and saw this. Looks like I was using the wrong syntax which I am glad to
know better now, but the GeoIP lookups are still not happening:
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
"scity=3D:dcity=3D"
I know the data file is good because it works with this:
# geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat 207.48.48.19
GeoIP City Edition, Rev 1: US, MO, Missouri, Chesterfield, 63017,
38.650002, -90.533401, 609, 314
In case it helps, I rebuilt argus-clients with the .debug flag file present
and then ran this command limited to only a single argus record that I
independently confirmed has a srcip value known to geoiplookup
# ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r
- -s label:50 -N200 -D3
ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler
(0x7f8eff3f7010, 0) returning 0x1b057c0
ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 RaLabelParseResourceFile
(/etc/ralabel.conf) returning 0
ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() read
16 bytes
ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection() read
112 bytes
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 ArgusInitAddrtoname
(0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145
ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155
ArgusReadConnection(0xff386010, 1) returning 1
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel
(0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) returning 0
Label
scity=3D:dcity=3D
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385
ArgusCloseInput(0xff386010) closing
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408
ArgusCloseInput(0xff386010) done
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: ArgusReadFileStream
(-) done
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files
completed
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0)
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete (0)
returning
ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 RaParseComplete(caught
signal 0)
[email protected]:~/argus-clients-3.0.8# ra -r /argus/today/unt-01.arg
-N1 -w - | ralabel -f /etc/ralabel.conf -r - -s label:50 -N200 -D8
ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree (0x26b2250)
ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree (0x26b22b0)
ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree (0x26b2310)
ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree (0x26b2370)
ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree (0x26b23d0)
ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree (0x26b2430)
ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree (0x26b2490)
ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree (0x26b24f0)
ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree (0x26b2550)
ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree (0x26b25b0)
ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree (0x26b2610)
ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, 80)
returning 0x26b2610
ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, 296)
returning 0x26b27c0
ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112)
returning 0x26b2950
ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, 80)
returning 0x26b25b0
ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () returning
0x26b25b0
ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8)
returning 0x2849a010
ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler
(0x7fa329100010, 0) returning 0x26b27c0
ralabel[4462.40472429a37f0000]: 15:53:24.384352 RaLabelParseResourceFile
(/etc/ralabel.conf) returning 0
ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, 560)
returning 0x26b2250
ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, 112)
returning 0x26b2e80
ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80)
returning 0x26b2f00
ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () returning
0x26b2f00
ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, 56)
returning 0x26b2f60
ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8)
returning 0x27358010
ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable (65536)
returning 0x26b2f60
ralabel[4462.40472429a37f0000]: 15:53:24.384483 ArgusReadConnection() read
16 bytes
ralabel[4462.40472429a37f0000]: 15:53:24.384498 ArgusReadConnection() read
112 bytes
ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304)
returning 0x26f57010
ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, 262144)
returning 0x26f16010
ralabel[4462.40472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname
(0x7fa329100010, 0xa9fe6700, 0xffffff00)
ralabel[4462.40472429a37f0000]: 15:53:24.385947
ArgusParseInit(0x7fa329100010 0x7fa32908f010
ralabel[4462.40472429a37f0000]: 15:53:24.385956
ArgusReadConnection(0x2908f010, 1) returning 1
ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileStream()
starting
ralabel[4462.40472429a37f0000]: 15:53:24.385981 ArgusReadStreamSocket
(0x7fa32908f010) read 380 bytes
ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384)
returning 0x26c58c0
ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, 12)
returning 0x26c5a50
ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, 80)
returning 0x26c5a70
ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36)
returning 0x26c5ad0
ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52)
returning 0x26c5b00
ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, 80)
returning 0x26c5b40
ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, 120)
returning 0x26c5ba0
ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8)
returning 0x26c5c20
ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, 164)
returning 0x26c5c40
ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, 20)
returning 0x26c5cf0
ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20)
returning 0x26c5d10
ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, 12)
returning 0x26c5d30
ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, 16)
returning 0x26c5d50
ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12)
returning 0x26c5e80
ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecordLabel
(0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning 0
Label
scity=3D:dcity=3D
ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree (0x26c5a50)
ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree (0x26c5a70)
ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree (0x26c5ad0)
ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree (0x26c5b00)
ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree (0x26c5b40)
ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree (0x26c5ba0)
ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree (0x26c5c20)
ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree (0x26c5c40)
ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree (0x26c5cf0)
ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree (0x26c5d10)
ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree (0x26c5d30)
ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree (0x26c5e80)
ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree (0x26c5d50)
ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree (0x26c58c0)
ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord
(0x2908f630) returning
ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord
(0x7fa329100010, 0x7fa32908f630) scheduled
ralabel[4462.40472429a37f0000]: 15:53:24.386408 ArgusHandleRecord
(0x7fa326f57010, 0x7fa329221800) returning 380
ralabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket
(0x7fa32908f010) returning 0
ralabel[4462.40472429a37f0000]: 15:53:24.386432 ArgusReadStreamSocket
(0x7fa32908f010) read 0 bytes
ralabel[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket
(0x7fa32908f010) returning 1
ralabel[4462.40472429a37f0000]: 15:53:24.386447 ArgusCloseInput(0x2908f010)
closing
ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree (0x7fa326f57010)
ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree (0x7fa326f16010)
ralabel[4462.40472429a37f0000]: 15:53:24.386492 ArgusCloseInput(0x2908f010)
done
ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream()
returning
ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: ArgusReadFileStream
(-) done
ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree (0x7fa32908f010)
ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading files
completed
ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0)
ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree (0x26b2190)
ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue
(0x26b2190) returning
ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree (0x26b21f0)
ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue
(0x26b21f0) returning
ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete (0)
returning
ralabel[4462.40472429a37f0000]: 15:53:24.386608 RaParseComplete(caught
signal 0)
Thanks for looking at this,
Kevin
On Sat, Sep 29, 2018 at 11:18 AM Carter Bullard <[email protected]> wrote:
> Hey Kevin,
> Any success ???
> Carter
>
> [image: QoSient] <http://qosient.com/>
> Carter Bullard <[email protected]>=E2=80=A2 CTO
> 150 E 57th Street Suite 12D
> New York, New York 10022-2795
> Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494
>
> On Sep 28, 2018, at 9:40 PM, David Edelman <[email protected]> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Please try this:
>
> # ra -r /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r -
> -s label:200 -N20
>
>
>
> From: Argus-info <
> [email protected]> On Behalf O=
f
> Kevin Branch
> Sent: Friday, September 28, 2018 5:25 PM
> To: Carter Bullard <[email protected]>
> Cc: Argus <[email protected]>
> Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2
>
>
>
> Looks like GeoIP is linked in already:
>
>
>
> # ldd `which ralabel`
> linux-vdso.so.1 =3D> (0x00007ffddaf8a000)
> libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c900=
0)
> libpthread.so.0 =3D> /lib/x86_64-linux-gnu/libpthread.so.0
> (0x00007f5fe65ab000)
> libGeoIP.so.1 =3D> /usr/lib/x86_64-linux-gnu/libGeoIP.so.1
> (0x00007f5fe637c000)
> libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb300=
0)
> /lib64/ld-linux-x86-64.so.2 (0x00007f5fe6acf000)
>
>
>
> I switched to just "lat,lon" like you suggested in ralabel.conf:
>
>
>
> # cat /etc/ralabel.conf
>
> RALABEL_ARIN_COUNTRY_CODES=3Dno
>
>
>
> RALABEL_GEOIP_ASN=3Dyes
>
> RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"
>
>
>
> RALABEL_GEOIP_CITY=3D"lat,lon"
>
> RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"
>
>
>
> But I don't see anything but ASNs getting added in:
>
>
>
> # ra -r /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r -
> -s sas,das,scity,dcity,icity | head -n20
>
> sAS dAS
>
> 4323
>
> 4323
>
> 4323
>
> 22927 4323
>
> 6582 4323
>
> 7018 4323
>
> 4323 3
>
> 4323
>
> 4323 15169
>
> 4323
>
> 4323
>
> 4323 15169
>
> 4323 21928
>
> 2828 4323
>
>
>
> Thoughts?
>
> Kevin
>
>
>
> On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard <[email protected] <
> mailto:[email protected] <[email protected]>> > wrote:
>
> Hey Kevin,
>
> If you do a ./configure =E2=80=94help you=E2=80=99ll see all the =
options that
> ./configure supports. If you specify =E2=80=94with-GeoIP it wants the di=
rectory
> where the GeoIP library is.
>
> =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <dir>
>
>
>
> You can check if the library is bound to the client binaries with
> ldd =E2=80=A6
>
> ldd `which ralabel`
>
>
>
> If you=E2=80=99re already bound, the city stuff should work =E2=
=80=A6. I=E2=80=99m not
> familiar with =E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the top=
of my head. I=E2=80=99m
> familiar with =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Mayb=
e try lat,lon as a
> test, as I use that all the time ..
>
>
>
> Carter
>
>
>
>
>
>
>
>
> On Sep 28, 2018, at 1:59 PM, Kevin Branch <
> [email protected] <mailto:[email protected]
> <[email protected]>> > wrote:
>
>
>
> Hi Carter,
>
>
>
> I was just trying today to make ralabel on argus 3.0.8.2
> do GeoIP labeling with GeoIPCity.dat, but even though the file referred t=
o
> in ralabel.conf for that purpose exists, no GeoIP labeling takes place.
> ASN lookups work great, but ralabel never adds any scity or dcity fields.
>
>
>
> My ralabel.conf:
>
>
>
> RALABEL_ARIN_COUNTRY_CODES=3Dno
>
>
>
> RALABEL_GEOIP_ASN=3Dyes
>
>
> RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"
>
>
>
> RALABEL_GEOIP_CITY=3D"reg,cco"
>
>
> RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"
>
>
>
> No errors are thrown by ralabel. I thought maybe I neede=
d
> to specially compile in GeoIP support like I read about here:
> https://qosient.com/argus/geolocation.shtml
>
> but when I run "./configure --with-GeoIP=3Dyes" it throws
> this error:
>
> configure: WARNING: unrecognized options:
> --with-GeoIP
>
> However, I presume the fact that ASN lookups work means
> that MaxMind GeoIP support libraries are already installed, and presumabl=
y
> installed by default in the latest argus now.
>
>
>
> # ra -r /argus/today/unt-01.arg -w - | ralabel -f
> /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20
>
> sAS dAS
>
> 4323
>
> 4323
>
> 4323
>
> 22927 4323
>
> 6582 4323
>
> 7018 4323
>
> 4323 3
>
> 4323
>
> 4323 15169
>
> 4323
>
> 4323
>
> 4323 15169
>
> 4323 21928
>
> 2828 4323
>
>
>
> Any thoughts on what I am missing or how I might further
> debug this issue?
>
>
>
> Thanks!
>
> Kevin
>
>
> -----BEGIN PGP SIGNATURE-----
>
> iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F
> IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D
> =3Dp/tg
> -----END PGP SIGNATURE-----
>
>
--000000000000a08d8a0577049e45
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Hi Cart=
er and David,<div><br></div><div>I just tried the following with the same r=
alabel.conf as before:</div></div><blockquote style=3D"margin:0px 0px 0px 4=
0px;border:none;padding:0px"><div dir=3D"ltr"><div>ra -r /argus/today/unt-0=
1.arg -w - | ralabel -f /etc/ralabel.conf -r - -s label:200=C2=A0 -N20</div=
></div></blockquote><div>and saw this.=C2=A0 Looks like I was using the wro=
ng syntax which I am glad to know better now, but the GeoIP lookups are sti=
ll not happening:</div><blockquote style=3D"margin:0px 0px 0px 40px;border:=
none;padding:0px"><div><div><div>"scity=3D:dcity=3D"</div></div><=
/div><div><div><div><div>"scity=3D:dcity=3D"</div></div></div></d=
iv><div><div><div><div>"scity=3D:dcity=3D"</div></div></div></div=
><div><div><div><div>"scity=3D:dcity=3D"</div></div></div></div><=
div><div><div><div>"scity=3D:dcity=3D"</div></div></div></div><di=
v><div><div><div>"scity=3D:dcity=3D"</div></div></div></div><div>=
<div><div><div>"scity=3D:dcity=3D"</div></div></div></div><div><d=
iv><div><div>"scity=3D:dcity=3D"</div></div></div></div><div><div=
><div><div>"scity=3D:dcity=3D"</div></div></div></div><div><div><=
div><div>"scity=3D:dcity=3D"</div></div></div></div><div><div><di=
v><div>"scity=3D:dcity=3D"</div></div></div></div><div><div><div>=
<div>"scity=3D:dcity=3D"</div></div></div></div></blockquote><div=
dir=3D"ltr"><div><br class=3D"gmail-Apple-interchange-newline"></div><div>=
I know the data file is good because it works with this:</div></div><blockq=
uote style=3D"margin:0px 0px 0px 40px;border:none;padding:0px"><div dir=3D"=
ltr"><div><div># geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat 207.48=
.48.19</div><div>GeoIP City Edition, Rev 1: US, MO, Missouri, Chesterfield,=
63017, 38.650002, -90.533401, 609, 314</div></div><div><br></div></div></b=
lockquote>In case it helps, I rebuilt argus-clients with the .debug flag fi=
le present and then ran this command limited to only a single argus record =
that I independently confirmed has a srcip value known to geoiplookup</div>=
<div dir=3D"ltr"><blockquote style=3D"margin:0px 0px 0px 40px;border:none;p=
adding:0px"><div><div># ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f=
/etc/ralabel.conf -r - -s label:50 -N200 -D3</div><div>ralabel[44570.40b75=
3ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler (0x7f8eff3f7010, 0) returning=
0x1b057c0</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 RaLab=
elParseResourceFile (/etc/ralabel.conf) returning 0</div><div>ralabel[44570=
.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() read 16 bytes</di=
v><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection=
() read 112 bytes</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.96113=
3 ArgusInitAddrtoname (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)</div><div>ra=
label[44570.40b753ff8e7f0000]: 15:52:57.961145 ArgusParseInit(0x7f8eff3f701=
0 0x7f8eff386010</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155=
ArgusReadConnection(0xff386010, 1) returning 1</div><div>ralabel[44570.40b=
753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel (0x7f8eff3f7010, 0x1b=
188c0, scity=3D:dcity=3D) returning 0</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Label</div><div>=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0scity=3D:dcity=
=3D</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 ArgusCloseIn=
put(0xff386010) closing</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57=
.961408 ArgusCloseInput(0xff386010) done</div><div>ralabel[44570.40b753ff8e=
7f0000]: 15:52:57.961415 main: ArgusReadFileStream (-) done</div><div>ralab=
el[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files completed</=
div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0)=
</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete=
(0) returning</div><div>ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 R=
aParseComplete(caught signal 0)</div><div>[email protected]:~/argus-cli=
ents-3.0.8# ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabe=
l.conf -r - -s label:50 -N200 -D8</div><div>ralabel[4462.40472429a37f0000]:=
15:53:24.374433 ArgusFree (0x26b2250)</div><div>ralabel[4462.40472429a37f0=
000]: 15:53:24.374461 ArgusFree (0x26b22b0)</div><div>ralabel[4462.40472429=
a37f0000]: 15:53:24.374469 ArgusFree (0x26b2310)</div><div>ralabel[4462.404=
72429a37f0000]: 15:53:24.374474 ArgusFree (0x26b2370)</div><div>ralabel[446=
2.40472429a37f0000]: 15:53:24.374479 ArgusFree (0x26b23d0)</div><div>ralabe=
l[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree (0x26b2430)</div><div>r=
alabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree (0x26b2490)</div><=
div>ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree (0x26b24f0)</=
div><div>ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree (0x26b25=
50)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree (0x=
26b25b0)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFre=
e (0x26b2610)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.374533 Arg=
usCalloc (1, 80) returning 0x26b2610</div><div>ralabel[4462.40472429a37f000=
0]: 15:53:24.374544 ArgusCalloc (1, 296) returning 0x26b27c0</div><div>rala=
bel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112) returning =
0x26b2950</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCa=
lloc (1, 80) returning 0x26b25b0</div><div>ralabel[4462.40472429a37f0000]: =
15:53:24.374595 ArgusNewQueue () returning 0x26b25b0</div><div>ralabel[4462=
.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8) returning 0x2849=
a010</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabe=
ler (0x7fa329100010, 0) returning 0x26b27c0</div><div>ralabel[4462.40472429=
a37f0000]: 15:53:24.384352 RaLabelParseResourceFile (/etc/ralabel.conf) ret=
urning 0</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCal=
loc (1, 560) returning 0x26b2250</div><div>ralabel[4462.40472429a37f0000]: =
15:53:24.384411 ArgusCalloc (1, 112) returning 0x26b2e80</div><div>ralabel[=
4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80) returning 0x26b=
2f00</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueu=
e () returning 0x26b2f00</div><div>ralabel[4462.40472429a37f0000]: 15:53:24=
.384430 ArgusCalloc (1, 56) returning 0x26b2f60</div><div>ralabel[4462.4047=
2429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8) returning 0x27358010<=
/div><div>ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable=
(65536) returning 0x26b2f60</div><div>ralabel[4462.40472429a37f0000]: 15:5=
3:24.384483 ArgusReadConnection() read 16 bytes</div><div>ralabel[4462.4047=
2429a37f0000]: 15:53:24.384498 ArgusReadConnection() read 112 bytes</div><d=
iv>ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304)=
returning 0x26f57010</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.38=
4523 ArgusCalloc (1, 262144) returning 0x26f16010</div><div>ralabel[4462.40=
472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname (0x7fa329100010, 0xa9f=
e6700, 0xffffff00)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.38594=
7 ArgusParseInit(0x7fa329100010 0x7fa32908f010</div><div>ralabel[4462.40472=
429a37f0000]: 15:53:24.385956 ArgusReadConnection(0x2908f010, 1) returning =
1</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileSt=
ream() starting</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.385981 A=
rgusReadStreamSocket (0x7fa32908f010) read 380 bytes</div><div>ralabel[4462=
.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384) returning 0x26c58c=
0</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1,=
12) returning 0x26c5a50</div><div>ralabel[4462.40472429a37f0000]: 15:53:24=
.386031 ArgusCalloc (1, 80) returning 0x26c5a70</div><div>ralabel[4462.4047=
2429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36) returning 0x26c5ad0</div=
><div>ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52) r=
eturning 0x26c5b00</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.38604=
7 ArgusCalloc (1, 80) returning 0x26c5b40</div><div>ralabel[4462.40472429a3=
7f0000]: 15:53:24.386053 ArgusCalloc (1, 120) returning 0x26c5ba0</div><div=
>ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8) returni=
ng 0x26c5c20</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386063 Argu=
sCalloc (1, 164) returning 0x26c5c40</div><div>ralabel[4462.40472429a37f000=
0]: 15:53:24.386070 ArgusCalloc (1, 20) returning 0x26c5cf0</div><div>ralab=
el[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20) returning 0x=
26c5d10</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCall=
oc (1, 12) returning 0x26c5d30</div><div>ralabel[4462.40472429a37f0000]: 15=
:53:24.386092 ArgusCalloc (1, 16) returning 0x26c5d50</div><div>ralabel[446=
2.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12) returning 0x26c5e8=
0</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecor=
dLabel (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning 0</div><div=
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0Label</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0scity=3D:dcity=3D</div><div>ralabel[4462.40472429a37f0000]: 15=
:53:24.386280 ArgusFree (0x26c5a50)</div><div>ralabel[4462.40472429a37f0000=
]: 15:53:24.386287 ArgusFree (0x26c5a70)</div><div>ralabel[4462.40472429a37=
f0000]: 15:53:24.386292 ArgusFree (0x26c5ad0)</div><div>ralabel[4462.404724=
29a37f0000]: 15:53:24.386297 ArgusFree (0x26c5b00)</div><div>ralabel[4462.4=
0472429a37f0000]: 15:53:24.386301 ArgusFree (0x26c5b40)</div><div>ralabel[4=
462.40472429a37f0000]: 15:53:24.386304 ArgusFree (0x26c5ba0)</div><div>rala=
bel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree (0x26c5c20)</div><div=
>ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree (0x26c5c40)</div=
><div>ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree (0x26c5cf0)=
</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree (0x26c=
5d10)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree (=
0x26c5d30)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusF=
ree (0x26c5e80)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386377 A=
rgusFree (0x26c5d50)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386=
384 ArgusFree (0x26c58c0)</div><div>ralabel[4462.40472429a37f0000]: 15:53:2=
4.386392 RaProcessRecord (0x2908f630) returning</div><div>ralabel[4462.4047=
2429a37f0000]: 15:53:24.386400 RaScheduleRecord (0x7fa329100010, 0x7fa32908=
f630) scheduled</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386408 A=
rgusHandleRecord (0x7fa326f57010, 0x7fa329221800) returning 380</div><div>r=
alabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket (0x7fa=
32908f010) returning 0</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.3=
86432 ArgusReadStreamSocket (0x7fa32908f010) read 0 bytes</div><div>ralabel=
[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket (0x7fa32908f=
010) returning 1</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386447 =
ArgusCloseInput(0x2908f010) closing</div><div>ralabel[4462.40472429a37f0000=
]: 15:53:24.386463 ArgusFree (0x7fa326f57010)</div><div>ralabel[4462.404724=
29a37f0000]: 15:53:24.386473 ArgusFree (0x7fa326f16010)</div><div>ralabel[4=
462.40472429a37f0000]: 15:53:24.386492 ArgusCloseInput(0x2908f010) done</di=
v><div>ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream(=
) returning</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386508 main:=
ArgusReadFileStream (-) done</div><div>ralabel[4462.40472429a37f0000]: 15:=
53:24.386522 ArgusFree (0x7fa32908f010)</div><div>ralabel[4462.40472429a37f=
0000]: 15:53:24.386529 main: reading files completed</div><div>ralabel[4462=
.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0)</div><div>ralabel[446=
2.40472429a37f0000]: 15:53:24.386546 ArgusFree (0x26b2190)</div><div>ralabe=
l[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue (0x26b2190) retu=
rning</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree (=
0x26b21f0)</div><div>ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusD=
eleteQueue (0x26b21f0) returning</div><div>ralabel[4462.40472429a37f0000]: =
15:53:24.386599 RaParseComplete (0) returning</div><div>ralabel[4462.404724=
29a37f0000]: 15:53:24.386608 RaParseComplete(caught signal 0)</div></div><d=
iv><br></div></blockquote></div><div dir=3D"ltr">Thanks for looking at this=
,</div><div dir=3D"ltr">Kevin<br><div dir=3D"ltr"><div><br></div></div></di=
v></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Sat, Sep 2=
9, 2018 at 11:18 AM Carter Bullard <<a href=3D"mailto:[email protected]=
">[email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quo=
te" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"=
><div dir=3D"auto">Hey Kevin,<div>Any success ???<br><div>Carter<br><br><di=
v id=3D"m_-1702863086885438903AppleMailSignature" dir=3D"ltr"><table id=3D"=
m_-1702863086885438903sig" width=3D"360" cellspacing=3D"0" cellpadding=3D"0=
" style=3D"font-family:UICTFontTextStyleBody;font-size:13pt;width:360px;mar=
gin:0px;padding:0px"><tbody><tr><td width=3D"142" style=3D"width:142px;marg=
in:0px;padding:0px"><a href=3D"http://qosient.com/" title=3D"QoSient" style=
=3D"text-decoration:none;border:none;color:rgb(149,79,114)" target=3D"_blan=
k"><img alt=3D"QoSient" style=3D"border:none;height:48px;line-height:48px;f=
ont-size:48px;font-family:'Gill Sans',sans-serif;color:rgb(0,0,0)">=
</a></td><td width=3D"20" style=3D"width:16px;min-width:16px;max-width:16px=
;margin:0px;padding:0px">=C2=A0</td><td style=3D"margin:0px;padding:0px;bor=
der-collapse:collapse"><table id=3D"m_-1702863086885438903sig2" cellspacing=
=3D"0" cellpadding=3D"0"><tbody><tr><td style=3D"white-space:nowrap;font-fa=
mily:'Gill Sans Light',sans-serif"><a href=3D"mailto:carter@qosient=
.com" style=3D"text-decoration:none;border:none;color:rgb(149,79,114)" targ=
et=3D"_blank"><span style=3D"line-height:16px;font-size:16px;color:rgb(0,0,=
176)">Carter Bullard</span>=C2=A0</a><span style=3D"line-height:14px;font-s=
ize:12px">=E2=80=A2</span>=C2=A0<span style=3D"line-height:14px;font-size:1=
2px">CTO</span></td></tr><tr><td style=3D"white-space:nowrap;font-family:&#=
39;Gill Sans Light',sans-serif"><span style=3D"line-height:14px;font-si=
ze:12px">150 E 57th Street Suite=C2=A012D</span></td></tr><tr><td style=3D"=
white-space:nowrap;font-family:'Gill Sans Light',sans-serif"><span =
style=3D"line-height:14px;font-size:12px">New York, New York 10022-2795</sp=
an></td></tr><tr><td style=3D"white-space:nowrap;font-family:'Gill Sans=
Light',sans-serif"><span style=3D"line-height:12px;font-size:12px">Pho=
ne +1.212.588.9133=C2=A0=E2=80=A2 Mobile +1.917.497.9494<br></span></td></t=
r></tbody></table></td></tr></tbody></table></div><div dir=3D"ltr"><br>On S=
ep 28, 2018, at 9:40 PM, David Edelman <<a href=3D"mailto:dedelman@iname=
.com" target=3D"_blank">[email protected]</a>> wrote:<br><br></div><blo=
ckquote type=3D"cite"><div dir=3D"ltr"><div class=3D"m_-1702863086885438903=
WordSection1"><p>-----BEGIN PGP SIGNED MESSAGE----- <br>Hash: SHA1 <u></u><=
u></u></p><p>Please try this: <u></u><u></u></p><p># ra -r /argus/today/unt=
-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s label:200=C2=A0 -N20 <u=
></u><u></u></p><p>=C2=A0 <u></u><u></u></p><p>From: Argus-info <<a href=
=3D"mailto:[email protected]" ta=
rget=3D"_blank">[email protected]=
u</a>> On Behalf Of Kevin Branch <br>Sent: Friday, September 28, 2018 5:=
25 PM <br>To: Carter Bullard <<a href=3D"mailto:[email protected]" targ=
et=3D"_blank">[email protected]</a>> <br>Cc: Argus <<a href=3D"mailt=
o:[email protected]" target=3D"_blank">[email protected]=
w.cmu.edu</a>> <br>Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=
<u></u><u></u></p><p>=C2=A0 <u></u><u></u></p><p>Looks like GeoIP is linke=
d in already: <u></u><u></u></p><p>=C2=A0 <u></u><u></u></p><p># ldd `which=
ralabel` <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 linux-vdso.so.1 =
=3D>=C2=A0 (0x00007ffddaf8a000) <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c900=
0) <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 libpthread.so.0 =3D> /=
lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000) <br>=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 libGeoIP.so.1 =3D> /usr/lib/x86_64-linux-=
gnu/libGeoIP.so.1 (0x00007f5fe637c000) <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe=
5fb3000) <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 /lib64/ld-linux-x86=
-64.so.2 (0x00007f5fe6acf000) <u></u><u></u></p><p>=C2=A0 <u></u><u></u></p=
><p>I switched to just "lat,lon" like you suggested in ralabel.co=
nf: <u></u><u></u></p><p>=C2=A0 <u></u><u></u></p><p># cat /etc/ralabel.con=
f <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL_A=
RIN_COUNTRY_CODES=3Dno <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 RALABEL_GEOIP_ASN=3Dyes <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/Ge=
oIP/GeoIPASNum.dat" <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 RALABEL_GEOIP_CITY=3D"lat,lon" <u></u><u></u></p><p>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL_GEOIP_CITY_FILE=3D"=
/usr/local/share/GeoIP/GeoIPCity.dat" <u></u><u></u></p><p>=C2=A0 <u><=
/u><u></u></p><p>But I don't see anything but ASNs getting added in: <u=
></u><u></u></p><p>=C2=A0 <u></u><u></u></p><p># ra -r /argus/today/unt-01.=
arg -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity |=
head -n20 <u></u><u></u></p><p>=C2=A0=C2=A0 sAS=C2=A0=C2=A0=C2=A0 dAS <u><=
/u><u></u></p><p>=C2=A0 4323 <u></u><u></u></p><p>=C2=A0 4323 <u></u><u></u=
></p><p>=C2=A0 4323 <u></u><u></u></p><p>=C2=A022927=C2=A0=C2=A0 4323 <u></=
u><u></u></p><p>=C2=A0 6582=C2=A0=C2=A0 4323 <u></u><u></u></p><p>=C2=A0 70=
18=C2=A0=C2=A0 4323 <u></u><u></u></p><p>=C2=A0 4323=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 3 <u></u><u></u></p><p>=C2=A0 4323 <u></u><u></u></p><p>=C2=A0 43=
23=C2=A0 15169 <u></u><u></u></p><p>=C2=A0 4323 <u></u><u></u></p><p>=C2=A0=
4323 <u></u><u></u></p><p>=C2=A0 4323=C2=A0 15169 <u></u><u></u></p><p>=C2=
=A0 4323=C2=A0 21928 <u></u><u></u></p><p>=C2=A0 2828=C2=A0=C2=A0 4323 <u><=
/u><u></u></p><p>=C2=A0 <u></u><u></u></p><p>Thoughts? <u></u><u></u></p><p=
>Kevin <u></u><u></u></p><p>=C2=A0 <u></u><u></u></p><p>On Fri, Sep 28, 201=
8 at 2:36 PM Carter Bullard <<a href=3D"mailto:[email protected]" targe=
t=3D"_blank">[email protected]</a> <<a href=3D"mailto:[email protected]=
m" target=3D"_blank">mailto:[email protected]</a>> > wrote: <u></u><=
u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Hey Kevin, <u></u><=
u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 If you do a ./confi=
gure =E2=80=94help you=E2=80=99ll see all the options that ./configure supp=
orts.=C2=A0 If you specify =E2=80=94with-GeoIP it wants the directory where=
the GeoIP library is.<u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =C2=A0 =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <di=
r> <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
<u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 You can ch=
eck if the library is bound to the client binaries with ldd =E2=80=A6 <u></=
u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0 ldd=
`which ralabel` <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 If you=E2=80=99re already bound, the city stuff should work =E2=80=A6.=
=C2=A0 I=E2=80=99m not familiar with =E2=80=9Creg,cco=E2=80=9D as GeoIP Cit=
y objects off the top of my head.=C2=A0 I=E2=80=99m familiar with =E2=80=9C=
off,cont,lat,lon,region,city,cname=E2=80=9D.=C2=A0 Maybe try lat,lon as a t=
est, as I use that all the time ..<u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 Carter <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 <u=
></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <br>=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 On Sep 28, 2018, at 1:59 PM, Kevin =
Branch <<a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a> <<a href=3D"mailto:kevin@branchnetc=
onsulting.com" target=3D"_blank">mailto:[email protected]</a>&g=
t; > wrote:<u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 Hi Carter, <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u=
></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 I was just trying today to make ralabel on argus 3.0.8.2=
do GeoIP labeling with GeoIPCity.dat, but even though the file referred to=
in ralabel.conf for that purpose exists, no GeoIP labeling takes place.=C2=
=A0=C2=A0=C2=A0 ASN lookups work great, but ralabel never adds any scity or=
dcity fields.<u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 My ralabel.conf: <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u>=
<u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL=
_ARIN_COUNTRY_CODES=3Dno <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL_GEOIP_ASN=3Dyes <u></u><u></u>=
</p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL_GEOIP=
_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" <u></u><u></u=
></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u>=
<u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL=
_GEOIP_CITY=3D"reg,cco" <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 RALABEL_GEOIP_CITY_FILE=3D"/usr/l=
ocal/share/GeoIP/GeoIPCity.dat" <u></u><u></u></p><p>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 No errors are thrown by ralabel.=C2=A0=
I thought maybe I needed to specially compile in GeoIP support like I read=
about here:=C2=A0=C2=A0 <a href=3D"https://qosient.com/argus/geolocation.s=
html" target=3D"_blank">https://qosient.com/argus/geolocation.shtml</a><u><=
/u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 but when I run "./configure --with-GeoIP=
=3Dyes" it throws this error: <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 configure: WARNING: unrecognized optio=
ns: --with-GeoIP <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 However, I presume the fa=
ct that ASN lookups work means that MaxMind GeoIP support libraries are alr=
eady installed, and presumably installed by default in the latest argus now=
.<u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 #=
ra -r /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s =
sas,das,scity,dcity,icity | head -n20<u></u><u></u></p><p>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=
=A0=C2=A0 sAS=C2=A0=C2=A0=C2=A0 dAS <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 =
4323 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 4323 <u></u><u></u></p><p>=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 =C2=A0 4323 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 22927=C2=A0=
=C2=A0 4323 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 6582=C2=A0=C2=A0 4323 <u=
></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 7018=C2=A0=C2=A0 4323 <u></u><u></u><=
/p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0 4323=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 3 <u></u><u></=
u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 =C2=A0 4323 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 =
4323=C2=A0 15169 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 4323 <u></u><u></u=
></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 =C2=A0 4323 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 432=
3=C2=A0 15169 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 4323=C2=A0 21928 <u><=
/u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0 2828=C2=A0=C2=A0 4323 <u></u><u></u></p>=
<p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Any thoughts on wha=
t I am missing or how I might further debug this issue? <u></u><u></u></p><=
p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Thanks! <u></u><u></u>=
</p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 Kevin <u></u><u></u></p><p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 <br>-----BEGIN PGP SIGNATURE----- <u></u><u></u></p><=
p>iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F <br>IdLw=
AKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D <br>=3Dp/tg =
<br>-----END PGP SIGNATURE----- <u></u><u></u></p></div></div></blockquote>=
</div></div></div></blockquote></div>
--000000000000a08d8a0577049e45--