MaxMind GeoIP support in 184.108.40.206
carter at qosient.com
Fri Sep 28 14:36:34 EDT 2018
If you do a ./configure —help you’ll see all the options that ./configure supports. If you specify —with-GeoIP it wants the directory where the GeoIP library is.
—with-GeoIP=DIR. compile with GeoIP in <dir>
You can check if the library is bound to the client binaries with ldd …
ldd `which ralabel`
If you’re already bound, the city stuff should work …. I’m not familiar with “reg,cco” as GeoIP City objects off the top of my head. I’m familiar with “off,cont,lat,lon,region,city,cname”. Maybe try lat,lon as a test, as I use that all the time ..
> On Sep 28, 2018, at 1:59 PM, Kevin Branch <kevin at branchnetconsulting.com> wrote:
> Hi Carter,
> I was just trying today to make ralabel on argus 220.127.116.11 do GeoIP labeling with GeoIPCity.dat, but even though the file referred to in ralabel.conf for that purpose exists, no GeoIP labeling takes place. ASN lookups work great, but ralabel never adds any scity or dcity fields.
> My ralabel.conf:
> No errors are thrown by ralabel. I thought maybe I needed to specially compile in GeoIP support like I read about here: https://qosient.com/argus/geolocation.shtml <https://qosient.com/argus/geolocation.shtml>but when I run "./configure --with-GeoIP=yes" it throws this error:
> configure: WARNING: unrecognized options: --with-GeoIP
> However, I presume the fact that ASN lookups work means that MaxMind GeoIP support libraries are already installed, and presumably installed by default in the latest argus now.
> # ra -r /argus/today/unt-01.arg -w - | ralabel -f /etc/ralabel.conf -r - -s sas,das,scity,dcity,icity | head -n20
> sAS dAS
> 22927 4323
> 6582 4323
> 7018 4323
> 4323 3
> 4323 15169
> 4323 15169
> 4323 21928
> 2828 4323
> Any thoughts on what I am missing or how I might further debug this issue?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the argus