Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Splunk has this capability via its Google Maps addon that allows you to map ip addresses that show up in your syslog. That way you can pinpoint geo locations of attacks such as scans.

Do you guys have any suggestions as to if and how this can be done with just a regular syslog server such as syslog-ng or a syslog software collecting the logs? How would you go about performing reverse lookups on the syslogs?

We have an ASA device that we want to analyze syslogs from to get a better idea about the location of external attacks.

Thank you kindly.

share|improve this question
add comment

1 Answer

These services use a Geo-IP database to do their lookups of IP addresses to physical locations. Some databases are cheap, some are (very) expensive - it depends on the level of granularity you want.

As to how to actually do this, I'm afraid I can't shed much light. I would extract each line into a database and do lookups against a GeoIP table - but there's possibly more efficient ways of doing it.

share|improve this answer
    
The GeoIP table lookups are very fast, since even a high-granularity table can be loaded into memory. So your "inefficient" approach is probably fine. –  mattdm Dec 2 '10 at 20:51
    
@matt - Good point, although I was more concerned about the inefficiency of getting the logs into the database in the first place. Parsing text log files can be difficult at the best of time. syslog software may have custom lookup abilities that might make it easier. –  Mark Henderson Dec 2 '10 at 21:30
    
Thank you Mark. I was hoping for a more specific answer for how to achieve this though so I might have to do some more digging around. –  Bourne Dec 3 '10 at 21:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.