LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-12-2012, 12:44 AM   #1
Balvinder87
Member
 
Registered: Jun 2012
Location: India
Distribution: debian
Posts: 77
Blog Entries: 1

Rep: Reputation: Disabled
Parsing The Entries of a BIND log Query file


I have installed BIND9 on my Debian system
we are in a network having local ips as 192.168.2.1 to 192.168.2.100
our bind log file sends its query details to a file called named_querylog
It has a sample entry like
12-Jul-2012 10:39:09.256 client 192.168.2.4#50151: query: www.godogle.com IN A + (192.168.2.4)
now we want to parse the local ip i.e. 192.168.2.4 into another file and this would be for each local ip between 192.168.2.1 to 192.168.2.100.
As we wan't to see the logs details of each client in the network for security purposes
Can any one help to generate the automated script for it script may be in bash or perl

Last edited by unSpawn; 07-12-2012 at 02:51 AM. Reason: //Use BB noparse tag on FQDN
 
Old 07-12-2012, 04:43 AM   #2
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
There are several ways to approach this, though all of them have some degree of similarity. The ultimate key to the problem lies in what are called regular expressions and this would be a good place for you to begin your research. Regular expressions are a pattern matching language and in your particular case you are looking to pattern match an IP address.

The approach that I would take would be to loop through the range of IP addresses, which runs from .1 to .100 (noting that you can use this number range as a loop variable. Then match the pattern of the IP address created based upon this variable to your file and PRINT the desired field (words or items separated by space). The first tool that comes to mind to do this is AWK (thought SED would probably work just as well, effectively acting as an advanced grep). See this page for some basic instructions on how to use AWK, along with some examples at the bottom: http://www.manpagez.com/man/1/awk/

As a starter example:
given tfile below, which would be your log file:
Code:
192.168.2.1 10000
192.168.2.1 20000
192.168.2.1 30000
192.168.2.2 10000
192.168.2.3 10000
192.168.2.5 10000
192.168.2.8 10000
Use a script like this
Code:
#! /bin/bash
for i in {1..10}
do
ipb="192.168.2."
ip=$ipb$i
echo "looking for $ip"
awk -v x=$ip '$1==x { print $2 }' tfile
done
And this gives:
Code:
looking for 192.168.2.1
10000
20000
30000
looking for 192.168.2.2
10000
looking for 192.168.2.3
10000
looking for 192.168.2.4
looking for 192.168.2.5
10000
looking for 192.168.2.6
looking for 192.168.2.7
looking for 192.168.2.8
10000
looking for 192.168.2.9
looking for 192.168.2.10
Note how it parses through the range of IP addresses, matches the lines with that IP address and prints out the desired field.
 
Old 07-12-2012, 08:03 AM   #3
Balvinder87
Member
 
Registered: Jun 2012
Location: India
Distribution: debian
Posts: 77

Original Poster
Blog Entries: 1

Rep: Reputation: Disabled
thanks for reply
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help with parsing log file sysmicuser Linux - Newbie 5 03-10-2012 05:50 PM
Script for parsing a log file pepepapa82 Linux - Newbie 3 10-04-2011 01:24 AM
BIND causing many entries in /var/log/messages when using IPv6 niels.horn Slackware 4 10-31-2009 06:31 PM
Parsing a log file jpostma Linux - Newbie 5 12-05-2008 03:58 PM
Help on parsing a log file in BASH globemast Programming 5 01-11-2007 01:56 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:42 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration