syslog-ng documentation

Your main source of knowledge

The syslog-ng product family has an extensive documentation, covering everything from how to install a product to the most complex configuration and settings descriptions. If you cannot find an answer to your question, try the mailing list - our community is always eager to help.

syslog-ng Open Source Edition

Contents

15.3. Looking up GeoIP2 data from IP addresses

The syslog-ng OSE application can lookup IP addresses from an offline GeoIP2 database, and make the retrieved data available in name-value pairs. Depending on the database used, you can access country code, longitude, and latitude information and so on.

The syslog-ng OSE application works with the Country and the City version of the GeoIP2 database, both free and the commercial editions. The syslog-ng OSE application works with the mmdb (GeoIP2) format of these databases. Other formats, like csv are not supported.

Note

To access longitude and latitude information, download the City version of the GeoIP2 database.

There are two types of GeoIP2 databases available.

  • GeoLite2 City:

    • free of charge

    • less accurate

  • GeoIP2 City:

    • has to be purchased

    • more accurate

Unzip the downloaded database (for example, to the /usr/share/GeoIP2/GeoIP2City.mmdb file). This path will be used later in the configuration.