/usr/share/logsparser/normalizers/GeoIPsource.xml is in python-logsparser 0.4-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 | <?xml version="1.0" encoding="UTF-8"?>
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- pylogparser - Logs parsers python library -->
<!-- Copyright (C) 2011 Wallix Inc. -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!-- -->
<!-- This package is free software; you can redistribute -->
<!-- it and/or modify it under the terms of the GNU Lesser -->
<!-- General Public License as published by the Free Software -->
<!-- Foundation; either version 2.1 of the License, or (at -->
<!-- your option) any later version. -->
<!-- -->
<!-- This package is distributed in the hope that it will be -->
<!-- useful, but WITHOUT ANY WARRANTY; without even the implied -->
<!-- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -->
<!-- PURPOSE. See the GNU Lesser General Public License for -->
<!-- more details. -->
<!-- -->
<!-- You should have received a copy of the GNU Lesser General -->
<!-- Public License along with this package; if not, write -->
<!-- to the Free Software Foundation, Inc., 59 Temple Place, -->
<!-- Suite 330, Boston, MA 02111-1307 USA -->
<!-- -->
<!--++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-->
<!DOCTYPE normalizer SYSTEM "normalizer.dtd">
<normalizer name="GeoIPsource"
version="0.99"
unicode="yes"
ignorecase="yes"
matchtype="match"
appliedTo="source_ip">
<description>
<localized_desc language="en">This filter evaluates the country of origin associated to the source_ip tag.</localized_desc>
<localized_desc language="fr">Ce filtre détermine le pays d'origine associé à la valeur du tag source_ip.</localized_desc>
</description>
<authors>
<author>mhu@wallix.com</author>
</authors>
<callbacks>
<callback name="decodeCountryOfOrigin">
country = country_code_by_address(value)
if country:
log['source_country'] = country</callback>
</callbacks>
<patterns>
<pattern name="GeoIP">
<description>
<localized_desc language="en">This pattern simply checks the source_ip tag.</localized_desc>
<localized_desc language="fr">Ce motif se contente d'analyser le tag source_ip.</localized_desc>
</description>
<text>IP</text>
<tags>
<tag name="__ip" tagType="IP">
<substitute>IP</substitute>
<callbacks>
<callback>decodeCountryOfOrigin</callback>
</callbacks>
</tag>
</tags>
<examples>
<example>
<text>8.8.8.8</text>
<expectedTags>
<expectedTag name="source_country">US</expectedTag>
</expectedTags>
</example>
<example>
<text>77.207.23.14</text>
<expectedTags>
<expectedTag name="source_country">FR</expectedTag>
</expectedTags>
</example>
</examples>
</pattern>
</patterns>
</normalizer>
|