OHarrisNetworks
asked on
HoneyD Honeypot Log parseing
Setup a honeypot running BackTrack, it's running HoneyD and we have a decent sized log file that needs parsed. I found this script:
When I run the script after installing the module I get the error: ImportError: No module named cymruwhois
This is the first time I've ever dealt with python so I'm open to other languages and other suggestions for solutions to my issue. I'm thinking I might be missing a mapping of the module library?
#!/usr/bin/python
from cymruwhois import Client
import sys
logfile = open('/var/log/honeypot/honeyd.log', 'r')
source = []
for line in logfile:
source.append(line.split(' ')[3])
src_country = []
src_count = []
c=Client()
results=c.lookupmany_dict(set(source))
for res in results:
country = results[res].cc
try:
pos = src_country.index( country )
src_count[pos] += 1
except:
src_country.append( country )
src_count.append( 1 )
for i in range( 0, ( len( src_country ) - 1 ) ):
sys.stdout.write( "%s:\t%i\n" %( src_country[i], src_count[i] ) )
I'm need to be able to parse the log to throw it into a couple of charts and graphs, this specific script is supposed to use the cymruwhois module out of rubygem to whois the public IP address's and get a count on how many IP's from each country.When I run the script after installing the module I get the error: ImportError: No module named cymruwhois
This is the first time I've ever dealt with python so I'm open to other languages and other suggestions for solutions to my issue. I'm thinking I might be missing a mapping of the module library?
The cymruwhois is not a standard module. This way it is not a part of your Python installation. It must be downloaded probably from here https://pypi.python.org/pypi/cymruwhois and installed. This way the cymruwhois will be placed among the site-packages , and you will be able to import it and to use it.
On the other hand, if your issue is with the parsing part, perhaps the "tokenizer" in this Parsing algorithm will be usefull.
;)
;)
ASKER
I will look into both.
ASKER
I've downloaded the cymruwhois egg, extracted it, within are cymruwhois.py and cymruwhois.py, I've attempted to python cymruwhois.py and it just sits.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.