Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

There is log-file /var/log/syslog with the output of ip-addresses like e.g. SRC=10.158.0.1.

I want to scan from this file every printed address in SRC= ... and then to make query with whois (SRC= ...).

This query should be monitored.

Mine attempt is wrong and looks like this in a bash-script:

#/bin/bash

while [ 1 ]
do
    grep ‘SRC=ip-address’ /var/log/syslog >> /home/$user/topsecret001/pitbull001.txt;
    whois ‘SRC=ip-address’ >> /home/$user/topsecret001/pitbull002.txt;
done

Can somebody help with a trick ? How should I define ip-address and how can I use command whois with this ip-address ?

The output of /var/log/syslog looks like this snippet here :

http://paste.ubuntu.com/5859332/

The output of /var/log/syslog looks like this - when there is a little alert (like today) :

http://paste.ubuntu.com/5862958/

Idea would be too - to perform a whois-query only if there is "invalid state" popping up in the line of the scrolling syslog.


Thank you for your contributions. I have learnt something by your codes. Often the solutions are looking easier than thought like here - cause I thought it would be more difficulty. I think with recent contribution of enzotib then this question is solved already now.

share|improve this question
    
When there are several correct answers at same time, then the least reputation will get the bounty, because I want to be fair. –  dschinn1001 Jul 9 '13 at 18:09
    
Can you post your /var/log/syslog file on paste.ubuntu.com and us give the link please. This because I don't have nothing like SRC= ... in my /var/log/syslog file. –  Radu Rădeanu Jul 9 '13 at 19:07
    
Don't know if I still have the old suiting log-file to this ip-address I mentioned above - but can post the actual of today as snippet with same ip, of course. –  dschinn1001 Jul 9 '13 at 19:13
    
wua ! already now - I don't know whom to give the bounty - will wait and think over 5 to 6 days. –  dschinn1001 Jul 9 '13 at 20:57
    
True ! - I slept a bit ... ;o) am somnambule ! –  dschinn1001 Jul 10 '13 at 8:45

5 Answers 5

up vote 7 down vote accepted
+50

Yet another solution:

awk '{ 
      for (i = 1; i <= NF; i++) 
        if ($i ~ /^SRC=/) 
          print substr($i, 5) 
    }' /var/log/syslog |
  sort -u |
  while read ip; do
    printf ' === %s ===\n' "$ip"
    whois "$ip"
  done

If you only want to select lines of syslog containing the string INVALID STATE, then the above code can be modified as follows

awk '/INVALID STATE/ { 
      for (i = 1; i <= NF; i++) 
        if ($i ~ /^SRC=/) 
          print substr($i, 5) 
    }' /var/log/syslog |
  sort -u |
  while read ip; do
    printf ' === %s ===\n' "$ip"
    whois "$ip"
  done
share|improve this answer
    
+1 for the answer, but I don't see the reason to apply 10 times whois $IP, if the same IP appear 10 times in /var/log/syslog (like is here: paste.ubuntu.com/5859332). Most probably the result of whois one_specific_ip will not change in the near future. –  Radu Rădeanu Jul 10 '13 at 4:42
1  
@RaduRădeanu: oh, you're right, changed. –  enzotib Jul 10 '13 at 6:38
    
@enzotib yes true - forgot to say this in question about a little built-in alert-modus. When there is an 'alien' ping or an 'alien' request then syslog list it with announcing "foreign address" in line. –  dschinn1001 Jul 10 '13 at 18:22
    
@enzotib sorry - not "foreign address" is popping up then - instead it is "invalid state" popping up ! –  dschinn1001 Jul 10 '13 at 21:33
    
@dschinn1001: see if the modified answer satisfies your new requirement. –  enzotib Jul 11 '13 at 6:25

You can use a sed command to extract all of the ip the IP addresses from the file, then use xargs to run whois for each match:

sed 's/^.*SRC=\([0-9.]*\).*$/\1/;t;d' < /var/log/syslog | xargs -n1 whois >> output.txt

The s/^.*SRC=\([0-9.]*\).*$/\1/ command replaces lines that contain SRC=x.x.x.x with just the IP address.

The 't;d' commands skips non-matching lines (thereby avoiding a separate grep command).

The xargs command invokes whois once for each address that sed outputs.


Alternatively, you can find and log the matching lines first, then extract the ip addresses separately:

grep -eSRC=[0-9.]* /var/log/syslog | tee grep-output.txt | sed 's/^.*SRC=\([0-9.]*\).*$/\1/' | xargs -n1 whois >> whois-output.txt`
share|improve this answer
    
This looks good, above in first solution /var/log/syslog is "docked" simply with '<' ? –  dschinn1001 Jul 9 '13 at 18:53
    
This looks good, above in first solution /var/log/syslog is "docked" simply with '<' ? –  dschinn1001 Jul 9 '13 at 19:09
    
The < sends the contents of /var/log/syslog to sed on stdin. –  cscarney Jul 9 '13 at 20:07
    
I get this error: Usage: whois [OPTION]... OBJECT... –  Radu Rădeanu Jul 9 '13 at 20:10
    
Does your syslog file contain any IP addresses? Add the -r flag to xargs if you need to handle the case where the list of addresses is empty. –  cscarney Jul 9 '13 at 20:17

Maybe the following code is a suitable starting point for you. It probably isn't the optimal solution, but it does its job.

It consists of a for loop over all lines of output of the command within $(). In each iteration of the loop, one line of output is stored in the variable IP. Then, in the loop, the whois command is called with $IP - the content of the variable IP - as argument.

The brackets $() enclose two grep commands - the first one is searching for IP addresses with SRC= written in front of them and the second one takes the output of the first one (via a pipe |) and just takes the IP address. The -o flag of grep causes it to only output the matched part of the lines instead of the full lines.

The regular expression is also not very elegant yet. It is searching for three groups, each consisting of one to three digits and a dot, followed again by one to three digits. To keep the script readable, I chose to use -E extended regular expressions. The "normal" grep command would require a backslash in front of every round and curly bracket...

for IP in \
 $(grep  -E "SRC=([0-9]{1,3}\.){3}[[0-9]{1,3}" -o  /var/log/syslog  | \
 grep -E "([0-9]{1,3}\.){3}[[0-9]{1,3}" -o);
    do whois $IP;
done
share|improve this answer
    
This solution is a more didactic one. –  dschinn1001 Jul 9 '13 at 19:19

Your script should look like this:

#/bin/bash

grep 'SRC=' /var/log/syslog | awk 'BEGIN {FS="[ \t]+|\\|"} {print $13}' | uniq >> ~/topsecret001/pitbull001.txt

for ip in $(sed -e 's/SRC=//g' ~/topsecret001/pitbull001.txt)
do 
    whois $ip >> ~/topsecret001/pitbull002.txt
done
share|improve this answer

For to add option - in case of popping up "INVALID STATE" - would then work this ? :

awk '{

    for (i = 1; i <= NF; i++)

      if ($i ~ /^SRC=/)

         print substr($i, 5)

   }' /var/log/syslog | sort -u | while read ip; 

do

   printf ' INVALID STATE ' && printf ' === %s ===\n' "$ip"

   whois "$ip"

 done
share|improve this answer
    
This code of enzotib works - after tested it. So this would then already work as new daemon. –  dschinn1001 Jul 10 '13 at 22:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.