Re: MaxMind GeoIP support in 3.0.8.2
"David Edelman" <[email protected]> Sat, 29 Sep 2018 15:47:16 -0400
| Newsgroups | gmane.network.argus |
|---|---|
| Message-ID | <[email protected]> |
This is a multipart message in MIME format. ------=_NextPart_000_0166_01D4580B.B32CF6E0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1=20 It looks like we are almost there, you need to indicate which addresses = need to have the labels associated=20 Please change this in your configuration file=20 =20 =20 RALABEL_GEOIP_CITY=3D"saddr,daddr:city "=20 =20 This information might help Looking at the code, the netmask is not = functional=20 =20 #=20 # Data for city relevant data is enabled through enabling and = configuring=20 # the city database support. The types of data available are:=20 # country_code, country_code3, country_name, region, city, = postal_code,=20 # latitude, longitude, metro_code, area_code and continent_code.=20 # time_offset is also available.=20 #=20 # The concept is that you should be able to add semantics for any=20 # IP address that is in the argus record. Support addresses are:=20 #=20 # saddr, daddr, inode=20 #=20 # The labels provided will be tagged as:=20 # scity, dcity, icity=20 #=20 # To configure what you want to have placed in the label, use the = list of=20 # objects, in whatever order you like, as the RALABEL_GEOPIP_CITY = string=20 # using these keywords:=20 # cco - country_code=20 # cco3 - country_code3=20 # cname - country_name=20 # reg - region=20 # city - city=20 # pcode - postal_code=20 # lat - latitude=20 # long - longitude=20 # metro - metro_code=20 # area - area_code=20 # cont - continent_code=20 # netmask - netmask value=20 #=20 # Working examples could be:=20 # RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon"=20 # RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon"=20 #=20 #RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,lat,lon"=20 #RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIP.dat"=20 =20 =20 =20 - --Dave=20 =20 =20 =20 From: Kevin Branch <[email protected]>=20 Sent: Saturday, September 29, 2018 11:57 AM=20 To: Carter Bullard <[email protected]>=20 Cc: David Edelman <[email protected]>; Argus = <[email protected]>=20 Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2=20 =20 Hi Carter and David,=20 =20 I just tried the following with the same ralabel.conf as before:=20 ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20=20 and saw this. Looks like I was using the wrong syntax which I am glad = to know better now, but the GeoIP lookups are still not happening: "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 "scity=3D:dcity=3D"=20 =20 I know the data file is good because it works with this:=20 # geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat = 207.48.48.19=20 GeoIP City Edition, Rev 1: US, MO, Missouri, Chesterfield, = 63017, 38.650002, -90.533401, 609, 314=20 =20 In case it helps, I rebuilt argus-clients with the .debug flag file = present and then ran this command limited to only a single argus record = that I independently confirmed has a srcip value known to geoiplookup # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f = /etc/ralabel.conf -r - -s label:50 -N200 -D3=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler = (0x7f8eff3f7010, 0) returning 0x1b057c0=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 = ArgusReadConnection() read 16 bytes=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 = ArgusReadConnection() read 112 bytes=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 = ArgusInitAddrtoname (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00)=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 = ArgusAddToRecordLabel (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) = returning 0 Label=20 scity=3D:dcity=3D=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading = files completed=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown = (0)=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete = (0) returning=20 ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 = RaParseComplete(caught signal 0)=20 [email protected]:~/argus-clients-3.0.8# = <mailto:[email protected]:~/argus-clients-3.0.8#> ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 -D8 ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree = (0x26b2250)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree = (0x26b22b0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree = (0x26b2310)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree = (0x26b2370)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree = (0x26b23d0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree = (0x26b2430)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree = (0x26b2490)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree = (0x26b24f0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree = (0x26b2550)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree = (0x26b25b0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree = (0x26b2610)=20 ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, = 80) returning 0x26b2610=20 ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, = 296) returning 0x26b27c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, = 112) returning 0x26b2950=20 ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, = 80) returning 0x26b25b0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () = returning 0x26b25b0=20 ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc = (65536, 8) returning 0x2849a010=20 ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler = (0x7fa329100010, 0) returning 0x26b27c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.384352 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0=20 ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, = 560) returning 0x26b2250=20 ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, = 112) returning 0x26b2e80=20 ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, = 80) returning 0x26b2f00=20 ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () = returning 0x26b2f00=20 ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, = 56) returning 0x26b2f60=20 ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc = (65536, 8) returning 0x27358010=20 ralabel[4462.40472429a37f0000]: 15:53:24.384461 = ArgusNewHashTable (65536) returning 0x26b2f60=20 ralabel[4462.40472429a37f0000]: 15:53:24.384483 = ArgusReadConnection() read 16 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.384498 = ArgusReadConnection() read 112 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, = 4194304) returning 0x26f57010=20 ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, = 262144) returning 0x26f16010=20 ralabel[4462.40472429a37f0000]: 15:53:24.385934 = ArgusInitAddrtoname (0x7fa329100010, 0xa9fe6700, 0xffffff00)=20 ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010=20 ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1=20 ralabel[4462.40472429a37f0000]: 15:53:24.385969 = ArgusReadFileStream() starting=20 ralabel[4462.40472429a37f0000]: 15:53:24.385981 = ArgusReadStreamSocket (0x7fa32908f010) read 380 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, = 384) returning 0x26c58c0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, = 12) returning 0x26c5a50=20 ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, = 80) returning 0x26c5a70=20 ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, = 36) returning 0x26c5ad0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, = 52) returning 0x26c5b00=20 ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, = 80) returning 0x26c5b40=20 ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, = 120) returning 0x26c5ba0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, = 8) returning 0x26c5c20=20 ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, = 164) returning 0x26c5c40=20 ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, = 20) returning 0x26c5cf0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, = 20) returning 0x26c5d10=20 ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, = 12) returning 0x26c5d30=20 ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, = 16) returning 0x26c5d50=20 ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, = 12) returning 0x26c5e80=20 ralabel[4462.40472429a37f0000]: 15:53:24.386234 = ArgusAddToRecordLabel (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) = returning 0 Label=20 scity=3D:dcity=3D=20 ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree = (0x26c5a50)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree = (0x26c5a70)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree = (0x26c5ad0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree = (0x26c5b00)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree = (0x26c5b40)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree = (0x26c5ba0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree = (0x26c5c20)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree = (0x26c5c40)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree = (0x26c5cf0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree = (0x26c5d10)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree = (0x26c5d30)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree = (0x26c5e80)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree = (0x26c5d50)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree = (0x26c58c0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord = (0x2908f630) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord = (0x7fa329100010, 0x7fa32908f630) scheduled=20 ralabel[4462.40472429a37f0000]: 15:53:24.386408 = ArgusHandleRecord (0x7fa326f57010, 0x7fa329221800) returning 380 ralabel[4462.40472429a37f0000]: 15:53:24.386417 = ArgusReadStreamSocket (0x7fa32908f010) returning 0=20 ralabel[4462.40472429a37f0000]: 15:53:24.386432 = ArgusReadStreamSocket (0x7fa32908f010) read 0 bytes=20 ralabel[4462.40472429a37f0000]: 15:53:24.386439 = ArgusReadStreamSocket (0x7fa32908f010) returning 1=20 ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing=20 ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree = (0x7fa326f57010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree = (0x7fa326f16010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done=20 ralabel[4462.40472429a37f0000]: 15:53:24.386500 = ArgusReadFileStream() returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done=20 ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree = (0x7fa32908f010)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading = files completed=20 ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown = (0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree = (0x26b2190)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue = (0x26b2190) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree = (0x26b21f0)=20 ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue = (0x26b21f0) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete = (0) returning=20 ralabel[4462.40472429a37f0000]: 15:53:24.386608 = RaParseComplete(caught signal 0)=20 =20 Thanks for looking at this,=20 Kevin=20 =20 =20 On Sat, Sep 29, 2018 at 11:18 AM Carter Bullard <[email protected] = <mailto:[email protected]> > wrote:=20 Hey Kevin,=20 Any success ???=20 Carter=20 <http://qosient.com/>=20 <http://qosient.com/>=20 Carter Bullard =E2=80=A2 CTO <http://qosient.com/>=20 150 E 57th Street Suite 12D <http://qosient.com/>=20 New York, New York 10022-2795 <http://qosient.com/>=20 Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 = <http://qosient.com/>=20 =20 On Sep 28, 2018, at 9:40 PM, David Edelman <[email protected]> = wrote: <http://qosient.com/>=20 -----BEGIN PGP SIGNED MESSAGE-----=20 Hash: SHA1 <http://qosient.com/>=20 Please try this: <http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s label:200 -N20 <http://qosient.com/>=20 <http://qosient.com/>=20 From: Argus-info = <[email protected]> On Behalf = Of Kevin Branch=20 Sent: Friday, September 28, 2018 5:25 PM=20 To: Carter Bullard <[email protected]>=20 Cc: Argus <[email protected]>=20 Subject: Re: [ARGUS] MaxMind GeoIP support in 3.0.8.2 = <http://qosient.com/>=20 <http://qosient.com/>=20 Looks like GeoIP is linked in already: = <http://qosient.com/>=20 <http://qosient.com/>=20 # ldd `which ralabel`=20 linux-vdso.so.1 =3D> (0x00007ffddaf8a000)=20 libm.so.6 =3D> /lib/x86_64-linux-gnu/libm.so.6 = (0x00007f5fe67c9000)=20 libpthread.so.0 =3D> = /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000)=20 libGeoIP.so.1 =3D> = /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f5fe637c000)=20 libc.so.6 =3D> /lib/x86_64-linux-gnu/libc.so.6 = (0x00007f5fe5fb3000)=20 /lib64/ld-linux-x86-64.so.2 (0x00007f5fe6acf000) = <http://qosient.com/>=20 <http://qosient.com/>=20 I switched to just "lat,lon" like you suggested in = ralabel.conf: <http://qosient.com/>=20 <http://qosient.com/>=20 # cat /etc/ralabel.conf <http://qosient.com/>=20 RALABEL_ARIN_COUNTRY_CODES=3Dno = <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_ASN=3Dyes <http://qosient.com/>=20 = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_CITY=3D"lat,lon" = <http://qosient.com/>=20 = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 But I don't see anything but ASNs getting added in: = <http://qosient.com/>=20 <http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 = <http://qosient.com/>=20 sAS dAS <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 22927 4323 <http://qosient.com/>=20 6582 4323 <http://qosient.com/>=20 7018 4323 <http://qosient.com/>=20 4323 3 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 <http://qosient.com/>=20 4323 21928 <http://qosient.com/>=20 2828 4323 <http://qosient.com/>=20 <http://qosient.com/>=20 Thoughts? <http://qosient.com/>=20 Kevin <http://qosient.com/>=20 <http://qosient.com/>=20 On Fri, Sep 28, 2018 at 2:36 PM Carter Bullard = <[email protected] <mailto:[email protected]> > wrote: = <http://qosient.com/>=20 Hey Kevin, <http://qosient.com/>=20 If you do a ./configure =E2=80=94help = you=E2=80=99ll see all the options that ./configure supports. If you = specify =E2=80=94with-GeoIP it wants the directory where the GeoIP = library is. <http://qosient.com/>=20 =E2=80=94with-GeoIP=3DDIR. compile with GeoIP = in <dir> <http://qosient.com/>=20 <http://qosient.com/>=20 You can check if the library is bound to the = client binaries with ldd =E2=80=A6 <http://qosient.com/>=20 ldd `which ralabel` <http://qosient.com/>=20 <http://qosient.com/>=20 If you=E2=80=99re already bound, the city stuff = should work =E2=80=A6. I=E2=80=99m not familiar with = =E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the top of my head. = I=E2=80=99m familiar with = =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe try lat,lon = as a test, as I use that all the time .. <http://qosient.com/>=20 <http://qosient.com/>=20 Carter <http://qosient.com/>=20 =20 <http://qosient.com/>=20 =20 =20 <http://qosient.com/>=20 On Sep 28, 2018, at 1:59 PM, Kevin = Branch <[email protected] = <mailto:[email protected]> > wrote: <http://qosient.com/>=20 <http://qosient.com/>=20 Hi Carter, <http://qosient.com/>=20 <http://qosient.com/>=20 I was just trying today to make ralabel = on argus 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even though = the file referred to in ralabel.conf for that purpose exists, no GeoIP = labeling takes place. ASN lookups work great, but ralabel never adds = any scity or dcity fields. <http://qosient.com/>=20 <http://qosient.com/>=20 My ralabel.conf: <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_ARIN_COUNTRY_CODES=3Dno = <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_ASN=3Dyes = <http://qosient.com/>=20 = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 RALABEL_GEOIP_CITY=3D"reg,cco" = <http://qosient.com/>=20 = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat" = <http://qosient.com/>=20 <http://qosient.com/>=20 No errors are thrown by ralabel. I = thought maybe I needed to specially compile in GeoIP support like I read = about here: https://qosient.com/argus/geolocation.shtml = <http://qosient.com/>=20 but when I run "./configure = --with-GeoIP=3Dyes" it throws this error: <http://qosient.com/>=20 configure: WARNING: unrecognized = options: --with-GeoIP <http://qosient.com/>=20 However, I presume the fact that ASN = lookups work means that MaxMind GeoIP support libraries are already = installed, and presumably installed by default in the latest argus now. = <http://qosient.com/>=20 <http://qosient.com/>=20 # ra -r /argus/today/unt-01.arg -w - | = ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head = -n20 <http://qosient.com/>=20 sAS dAS <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 22927 4323 <http://qosient.com/>=20 6582 4323 <http://qosient.com/>=20 7018 4323 <http://qosient.com/>=20 4323 3 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 <http://qosient.com/>=20 4323 15169 <http://qosient.com/>=20 4323 21928 <http://qosient.com/>=20 2828 4323 <http://qosient.com/>=20 <http://qosient.com/>=20 Any thoughts on what I am missing or how = I might further debug this issue? <http://qosient.com/>=20 <http://qosient.com/>=20 Thanks! <http://qosient.com/>=20 Kevin <http://qosient.com/>=20 =20 -----BEGIN PGP SIGNATURE----- <http://qosient.com/>=20 = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F=20 = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D=20 =3Dp/tg=20 -----END PGP SIGNATURE----- <http://qosient.com/>=20 -----BEGIN PGP SIGNATURE-----=20 iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRCXCCyZOY1F=20 IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D=20 =3DeoBH=20 -----END PGP SIGNATURE-----=20 ------=_NextPart_000_0166_01D4580B.B32CF6E0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta = http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta = name=3DGenerator content=3D"Microsoft Word 15 (filtered = medium)"><style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} p.msonormal0, li.msonormal0, div.msonormal0 {mso-style-name:msonormal; mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:0in; font-size:11.0pt; font-family:"Calibri",sans-serif;} span.EmailStyle19 {mso-style-type:personal-compose;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue = vlink=3Dpurple><div class=3DWordSection1><p>-----BEGIN PGP SIGNED = MESSAGE----- <br>Hash: SHA1 <o:p></o:p></p><p>It looks like we are = almost there, you need to indicate which addresses need to have the = labels associated <o:p></o:p></p><p>Please change this in your = configuration file <o:p></o:p></p><p> <o:p></o:p></p><p> = <o:p></o:p></p><p>RALABEL_GEOIP_CITY=3D"saddr,daddr:city " = <o:p></o:p></p><p> <o:p></o:p></p><p>This information might help = Looking at the code, the netmask is not functional = <o:p></o:p></p><p> <o:p></o:p></p><p># = <o:p></o:p></p><p># Data for city relevant data is = enabled through enabling and configuring = <o:p></o:p></p><p># the city database support. = The types of data available are: = <o:p></o:p></p><p># country_code, = country_code3, country_name, region, city, postal_code, = <o:p></o:p></p><p># latitude, = longitude, metro_code, area_code and continent_code. = <o:p></o:p></p><p># time_offset is = also available. <o:p></o:p></p><p># = <o:p></o:p></p><p># The concept is that you should be = able to add semantics for any <o:p></o:p></p><p># IP = address that is in the argus record. Support addresses are: = <o:p></o:p></p><p># = <o:p></o:p></p><p># saddr, daddr, = inode <o:p></o:p></p><p># <o:p></o:p></p><p># The = labels provided will be tagged as: = <o:p></o:p></p><p># scity, dcity, = icity <o:p></o:p></p><p># <o:p></o:p></p><p># To = configure what you want to have placed in the label, use the list of = <o:p></o:p></p><p># objects, in whatever order you = like, as the RALABEL_GEOPIP_CITY string = <o:p></o:p></p><p># using these keywords: = <o:p></o:p></p><p># cco = - country_code = <o:p></o:p></p><p># cco3 - = country_code3 <o:p></o:p></p><p># = cname - country_name = <o:p></o:p></p><p># reg = - region <o:p></o:p></p><p># = city - city <o:p></o:p></p><p># = pcode - postal_code = <o:p></o:p></p><p># lat = - latitude <o:p></o:p></p><p># = long - longitude <o:p></o:p></p><p># = metro - metro_code = <o:p></o:p></p><p># area - = area_code <o:p></o:p></p><p># = cont - continent_code <o:p></o:p></p><p># = netmask - netmask value <o:p></o:p></p><p># = <o:p></o:p></p><p># Working examples could be: = <o:p></o:p></p><p># = RALABEL_GEOIP_CITY=3D"saddr,daddr:lat/lon" = <o:p></o:p></p><p># = RALABEL_GEOIP_CITY=3D"*:city,region,cname,lat,lon" = <o:p></o:p></p><p># = <o:p></o:p></p><p>#RALABEL_GEOIP_CITY=3D"saddr,daddr,inode:off,cont,= lat,lon" = <o:p></o:p></p><p>#RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP= /GeoIP.dat" <o:p></o:p></p><p> <o:p></o:p></p><p> = <o:p></o:p></p><p> <o:p></o:p></p><p>- --Dave = <o:p></o:p></p><p> <o:p></o:p></p><p> = <o:p></o:p></p><p> <o:p></o:p></p><p>From: Kevin Branch = <[email protected]> <br>Sent: Saturday, September 29, = 2018 11:57 AM <br>To: Carter Bullard <[email protected]> <br>Cc: = David Edelman <[email protected]>; Argus = <[email protected]> <br>Subject: Re: [ARGUS] MaxMind = GeoIP support in 3.0.8.2 <o:p></o:p></p><p> <o:p></o:p></p><p>Hi = Carter and David, <o:p></o:p></p><p> <o:p></o:p></p><p>I just = tried the following with the same ralabel.conf as before: = <o:p></o:p></p><p> ra -r = /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s = label:200 -N20 <o:p></o:p></p><p>and saw this. Looks like I = was using the wrong syntax which I am glad to know better now, but the = GeoIP lookups are still not = happening:<o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" = <o:p></o:p></p><p> = "scity=3D:dcity=3D" <o:p></o:p></p><p> = <o:p></o:p></p><p>I know the data file is good because it works with = this: <o:p></o:p></p><p> # = geoiplookup -f /usr/local/share/GeoIP/GeoIPCity.dat 207.48.48.19 = <o:p></o:p></p><p> GeoIP City = Edition, Rev 1: US, MO, Missouri, Chesterfield, 63017, 38.650002, = -90.533401, 609, 314 = <o:p></o:p></p><p> = <o:p></o:p></p><p>In case it helps, I rebuilt argus-clients with the = .debug flag file present and then ran this command limited to only a = single argus record that I independently confirmed has a srcip value = known to = geoiplookup<o:p></o:p></p><p> = # ra -r /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf = -r - -s label:50 -N200 -D3 = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.950161 ArgusNewLabeler = (0x7f8eff3f7010, 0) returning 0x1b057c0 = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959656 = RaLabelParseResourceFile (/etc/ralabel.conf) returning 0 = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959730 ArgusReadConnection() = read 16 bytes = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.959748 ArgusReadConnection() = read 112 bytes = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961133 ArgusInitAddrtoname = (0x7f8eff3f7010, 0xa9fe6700, 0xffffff00) = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961145 = ArgusParseInit(0x7f8eff3f7010 0x7f8eff386010 = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961155 = ArgusReadConnection(0xff386010, 1) returning 1 = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961329 ArgusAddToRecordLabel = (0x7f8eff3f7010, 0x1b188c0, scity=3D:dcity=3D) returning = 0<o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; Label = <o:p></o:p></p><p> = &= nbsp; &n= bsp; = scity=3D:dcity=3D = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961385 = ArgusCloseInput(0xff386010) closing = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961408 = ArgusCloseInput(0xff386010) done = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961415 main: = ArgusReadFileStream (-) done = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961426 main: reading files = completed <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961432 ArgusShutDown (0) = <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961439 RaParseComplete (0) = returning <o:p></o:p></p><p> = ralabel[44570.40b753ff8e7f0000]: 15:52:57.961444 RaParseComplete(caught = signal 0) <o:p></o:p></p><p> = [email protected]:~/argus-clients-3.0.8# <<a = href=3D"mailto:[email protected]:~/argus-clients-3.0.8">mailto:root@n= sm.wycliffe.org:~/argus-clients-3.0.8</a>#> ra -r = /argus/today/unt-01.arg -N1 -w - | ralabel -f /etc/ralabel.conf -r - -s = label:50 -N200 = -D8<o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374433 ArgusFree (0x26b2250) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374461 ArgusFree (0x26b22b0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374469 ArgusFree (0x26b2310) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374474 ArgusFree (0x26b2370) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374479 ArgusFree (0x26b23d0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374484 ArgusFree (0x26b2430) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374489 ArgusFree (0x26b2490) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374494 ArgusFree (0x26b24f0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374499 ArgusFree (0x26b2550) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374504 ArgusFree (0x26b25b0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374509 ArgusFree (0x26b2610) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374533 ArgusCalloc (1, 80) = returning 0x26b2610 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374544 ArgusCalloc (1, 296) = returning 0x26b27c0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374566 ArgusCalloc (1, 112) = returning 0x26b2950 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374577 ArgusCalloc (1, 80) = returning 0x26b25b0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374595 ArgusNewQueue () = returning 0x26b25b0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374613 ArgusCalloc (65536, 8) = returning 0x2849a010 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.374619 ArgusNewLabeler = (0x7fa329100010, 0) returning 0x26b27c0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384352 RaLabelParseResourceFile = (/etc/ralabel.conf) returning 0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384387 ArgusCalloc (1, 560) = returning 0x26b2250 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384411 ArgusCalloc (1, 112) = returning 0x26b2e80 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384418 ArgusCalloc (1, 80) = returning 0x26b2f00 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384424 ArgusNewQueue () = returning 0x26b2f00 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384430 ArgusCalloc (1, 56) = returning 0x26b2f60 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384454 ArgusCalloc (65536, 8) = returning 0x27358010 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384461 ArgusNewHashTable = (65536) returning 0x26b2f60 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384483 ArgusReadConnection() = read 16 bytes = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384498 ArgusReadConnection() = read 112 bytes = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384514 ArgusCalloc (1, 4194304) = returning 0x26f57010 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.384523 ArgusCalloc (1, 262144) = returning 0x26f16010 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.385934 ArgusInitAddrtoname = (0x7fa329100010, 0xa9fe6700, 0xffffff00) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.385947 = ArgusParseInit(0x7fa329100010 0x7fa32908f010 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.385956 = ArgusReadConnection(0x2908f010, 1) returning 1 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.385969 ArgusReadFileStream() = starting <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.385981 ArgusReadStreamSocket = (0x7fa32908f010) read 380 bytes = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386015 ArgusCalloc (1, 384) = returning 0x26c58c0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386025 ArgusCalloc (1, 12) = returning 0x26c5a50 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386031 ArgusCalloc (1, 80) = returning 0x26c5a70 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386037 ArgusCalloc (1, 36) = returning 0x26c5ad0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386042 ArgusCalloc (1, 52) = returning 0x26c5b00 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386047 ArgusCalloc (1, 80) = returning 0x26c5b40 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386053 ArgusCalloc (1, 120) = returning 0x26c5ba0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386058 ArgusCalloc (1, 8) = returning 0x26c5c20 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386063 ArgusCalloc (1, 164) = returning 0x26c5c40 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386070 ArgusCalloc (1, 20) = returning 0x26c5cf0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386075 ArgusCalloc (1, 20) = returning 0x26c5d10 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386080 ArgusCalloc (1, 12) = returning 0x26c5d30 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386092 ArgusCalloc (1, 16) = returning 0x26c5d50 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386131 ArgusCalloc (1, 12) = returning 0x26c5e80 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386234 ArgusAddToRecordLabel = (0x7fa329100010, 0x26c58c0, scity=3D:dcity=3D) returning = 0<o:p></o:p></p><p> = &= nbsp; &n= bsp; &nb= sp; Label = <o:p></o:p></p><p> = &= nbsp; &n= bsp; = scity=3D:dcity=3D = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386280 ArgusFree (0x26c5a50) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386287 ArgusFree (0x26c5a70) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386292 ArgusFree (0x26c5ad0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386297 ArgusFree (0x26c5b00) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386301 ArgusFree (0x26c5b40) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386304 ArgusFree (0x26c5ba0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386308 ArgusFree (0x26c5c20) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386312 ArgusFree (0x26c5c40) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386316 ArgusFree (0x26c5cf0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386322 ArgusFree (0x26c5d10) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386359 ArgusFree (0x26c5d30) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386369 ArgusFree (0x26c5e80) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386377 ArgusFree (0x26c5d50) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386384 ArgusFree (0x26c58c0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386392 RaProcessRecord = (0x2908f630) returning = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386400 RaScheduleRecord = (0x7fa329100010, 0x7fa32908f630) scheduled = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386408 ArgusHandleRecord = (0x7fa326f57010, 0x7fa329221800) returning = 380<o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386417 ArgusReadStreamSocket = (0x7fa32908f010) returning 0 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386432 ArgusReadStreamSocket = (0x7fa32908f010) read 0 bytes = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386439 ArgusReadStreamSocket = (0x7fa32908f010) returning 1 = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386447 = ArgusCloseInput(0x2908f010) closing = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386463 ArgusFree = (0x7fa326f57010) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386473 ArgusFree = (0x7fa326f16010) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386492 = ArgusCloseInput(0x2908f010) done = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386500 ArgusReadFileStream() = returning <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386508 main: = ArgusReadFileStream (-) done = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386522 ArgusFree = (0x7fa32908f010) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386529 main: reading files = completed <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386536 ArgusShutDown (0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386546 ArgusFree (0x26b2190) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386553 ArgusDeleteQueue = (0x26b2190) returning = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386561 ArgusFree (0x26b21f0) = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386569 ArgusDeleteQueue = (0x26b21f0) returning = <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386599 RaParseComplete (0) = returning <o:p></o:p></p><p> = ralabel[4462.40472429a37f0000]: 15:53:24.386608 RaParseComplete(caught = signal 0) = <o:p></o:p></p><p> = <o:p></o:p></p><p>Thanks for looking at this, <o:p></o:p></p><p>Kevin = <o:p></o:p></p><p> <o:p></o:p></p><p> <o:p></o:p></p><p>On = Sat, Sep 29, 2018 at 11:18 AM Carter Bullard <[email protected] = <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > wrote: <o:p></o:p></p><p> = Hey Kevin, <o:p></o:p></p><p> = Any success ??? = <o:p></o:p></p><p> Carter = <o:p></o:p></p><p><<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p>Carter Bullard =E2=80=A2 CTO <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p>150 E 57th Street Suite 12D <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p>New York, New York 10022-2795 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p>Phone +1.212.588.9133 =E2=80=A2 Mobile +1.917.497.9494 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <br> On Sep 28, 2018, at 9:40 = PM, David Edelman <[email protected]> wrote: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = -----BEGIN PGP SIGNED = MESSAGE----- <br> = Hash: SHA1 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = Please try this: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = # ra -r = /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s = label:200 -N20 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = From: Argus-info = <[email protected]> On = Behalf Of Kevin Branch = <o:p></o:p></p><p> = Sent: Friday, September 28, = 2018 5:25 PM <br> = To: Carter Bullard = <[email protected]> = <br> = Cc: Argus = <[email protected]> = <br> = Subject: Re: [ARGUS] MaxMind = GeoIP support in 3.0.8.2 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = Looks like GeoIP is linked in = already: <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = # ldd `which ralabel` = <br> = = linux-vdso.so.1 =3D> = (0x00007ffddaf8a000) <br> = = libm.so.6 =3D> = /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5fe67c9000) = <br> = = libpthread.so.0 =3D> = /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f5fe65ab000) = <br> = = libGeoIP.so.1 =3D> = /usr/lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f5fe637c000) = <br> = = libc.so.6 =3D> = /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5fe5fb3000) = <br> = = /lib64/ld-linux-x86-64.so.2 = (0x00007f5fe6acf000) <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = I switched to just = "lat,lon" like you suggested in ralabel.conf: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = # cat /etc/ralabel.conf = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = RALABEL_GEOIP_ASN=3Dyes = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = RALABEL_GEOIP_CITY=3D"lat,lon" <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = But I don't see anything but = ASNs getting added in: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = # ra -r = /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s = sas,das,scity,dcity,icity | head -n20 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = sAS dAS <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 22927 4323 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 6582 4323 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 7018 4323 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = 4323 3 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 15169 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 15169 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 4323 21928 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = 2828 4323 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = Thoughts? <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = Kevin <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = On Fri, Sep 28, 2018 at 2:36 = PM Carter Bullard <[email protected] <<a = href=3D"mailto:[email protected]">mailto:[email protected]</a>> = > wrote: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = Hey Kevin, <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = If you do a ./configure = =E2=80=94help you=E2=80=99ll see all the options that ./configure = supports. If you specify =E2=80=94with-GeoIP it wants the = directory where the GeoIP library is. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = =E2=80=94with-GeoIP=3DDIR. compile with GeoIP in <dir> <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = You can check if the library = is bound to the client binaries with ldd =E2=80=A6 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = ldd `which = ralabel` <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = If you=E2=80=99re already = bound, the city stuff should work =E2=80=A6. I=E2=80=99m not = familiar with =E2=80=9Creg,cco=E2=80=9D as GeoIP City objects off the = top of my head. I=E2=80=99m familiar with = =E2=80=9Coff,cont,lat,lon,region,city,cname=E2=80=9D. Maybe try = lat,lon as a test, as I use that all the time .. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = Carter <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = <br> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = <br> = = = <br> = = <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; On Sep 28, 2018, at 1:59 PM, Kevin Branch = <[email protected] <<a = href=3D"mailto:[email protected]">mailto:kevin@branchnetconsu= lting.com</a>> > wrote: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; Hi Carter, <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; I was just trying today to make ralabel on argus = 3.0.8.2 do GeoIP labeling with GeoIPCity.dat, but even though the file = referred to in ralabel.conf for that purpose exists, no GeoIP labeling = takes place. ASN lookups work great, but ralabel never = adds any scity or dcity fields. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; My ralabel.conf: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = RALABEL_ARIN_COUNTRY_CODES=3Dno <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = RALABEL_GEOIP_ASN=3Dyes <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = RALABEL_GEOIP_ASN_FILE=3D"/usr/local/share/GeoIP/GeoIPASNum.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = RALABEL_GEOIP_CITY=3D"reg,cco" <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = RALABEL_GEOIP_CITY_FILE=3D"/usr/local/share/GeoIP/GeoIPCity.dat"= ; <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; No errors are thrown by ralabel. I thought maybe = I needed to specially compile in GeoIP support like I read about = here: <a = href=3D"https://qosient.com/argus/geolocation.shtml">https://qosient.com/= argus/geolocation.shtml</a> <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; but when I run "./configure = --with-GeoIP=3Dyes" it throws this error: <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; = configure: WARNING: unrecognized options: --with-GeoIP <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; However, I presume the fact that ASN lookups work = means that MaxMind GeoIP support libraries are already installed, and = presumably installed by default in the latest argus now. <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; # ra -r /argus/today/unt-01.arg -w - | ralabel -f = /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; sAS dAS <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 22927 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 6582 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 7018 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 3 = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 15169 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 15169 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 4323 21928 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; 2828 4323 <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; Any thoughts on what I am missing or how I might = further debug this issue? <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; Thanks! <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = &= nbsp; Kevin <<a = href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = = <br> = -----BEGIN PGP SIGNATURE----- = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <o:p></o:p></p><p> = = iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW67X6gAKCRCXCCyZOY1F = <br> = = IdLwAKDv6tPpe7OwLBEEfM1YTnAD8MxZCgCeOlGEEuEIUvqlyIMh8CPBWctmBd0=3D = <br> = =3Dp/tg = <br> = -----END PGP SIGNATURE----- = <<a href=3D"http://qosient.com/">http://qosient.com/</a>> = <br>-----BEGIN PGP SIGNATURE----- = <o:p></o:p></p><p>iF0EARECAB0WIQQP+UHquEepll566aqXCCyZOY1FIQUCW6/WuAAKCRC= XCCyZOY1F = <br>IYGaAKDk/9QFqcgbEWN6bN9eMNitGAXU7ACfduIQKuGR7lsDTCkdRogye0u8TxM=3D = <br>=3DeoBH <br>-----END PGP SIGNATURE----- = <o:p></o:p></p></div></body></html> ------=_NextPart_000_0166_01D4580B.B32CF6E0--