About bryansampsel

bryansampsel · ‎10-10-2019

I have DBConnect 3.1.4. It lists out OpenJDK 1.8 specifically. I'm running Ubuntu server 18.04.3 LTS. I loaded openjdk-8-jre-headless/bionic-updates,bionic-security,now 8u222-b10-1ubuntu1~18.04.1 amd64 or as the java -version says: openjdk version "1.8.0_222" OpenJDK Runtime Environment (build 1.8.0_222-8u222-b10-1ubuntu1~18.04.1-b10) OpenJDK 64-Bit Server VM (build 25.222-b10, mixed mode) However, when I try to configure the JAVA_HOME variable, I get the following: {'message': 'Unsupported JRE detected', 'jre_need': 'Need Oracle Corporation JRE version 1.8 or OpenSDK 1.8', 'jre_using': 'Using Private Build JRE version 1.8, OpenJDK 64-Bit Server VM'} validate java command: /usr/lib/jvm/java-8-openjdk-amd64/bin/java. Any ideas?

bryansampsel · ‎08-30-2012

True, that gives me the ability to figure out the country of origin. However, I was after the logic to do comparisons...SPLUNK hooked me up with a solution, but it's quite resource intensive. Search: index="ironmail" sourcetype="IronMail" from=".ru" [search index="ironmail" sourcetype="IronMail" to=".ru" | eval from=to | fields from] | append [search index="ironmail" sourcetype="IronMail" to=".ru" [search index="ironmail" sourcetype="IronMail" from=".ru" | eval to=from | fields to]] | table _time,source,ironmail_ip,mesgID,from,to,received_ip,routedomain And that doesn't even include what you suggest, leveraging a whois server to identify the box, let alone GeoIP. With very small time windows, I can run this and effectively get what I'm after. In truth, it's probably better to track email "conversations" from the logs of Exchange itself, to more effectively minimize the white noise of false matches. Thanks for the feedback.

bryansampsel · ‎04-23-2012

Here's the scenario: An email comes in from China to my mail server to a particular user. It could be SPAM. What I care about is if that user responds to the email, or I see that user send an email to China and China responds. I don't care about one-way mail, but where there appears to be a conversation. Now, I can't simply match up with a simple "sender=.cn AND receiver=.cn" -- logic doesn't work. It's too simplistic. If I was scripting this in PERL, I'd build a list of senders and bounce the list of receivers against it. Does anyone know a good way to effectively do the same thing in SPLUNK? It boils down to comparing all the "to" values against all the "from" values and generating my results from that. The particular log format (Sendmail, Postfix, etc) is irrelevant. Any ideas are welcome.

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-02-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

DBConnect 3.1.4: Doesn't recognize OpenJDK 1.8 on ...

Mail Tracking

DBConnect 3.1.4: Doesn't recognize OpenJDK 1.8 on ...

Re: Mail Tracking

Mail Tracking