Edit: /var/log/talon/talon-events-2017-04-29.log (16384B)
SQLite format 3 @ "
wQtablelogslogsCREATE TABLE logs(id int auto increment,timestamp datetime default current_timestamp,message text)
Ώ ϋφρμηβέΨΣΞΙΔΏ46{u'message': {u'account': u'a15dagib', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'db8fcff2-2c76-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-04-29 00:57:45{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'unblock'], u'account': u'a15dagib', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta':
!
32017-04-29 00:57:46{u'message': {u'account': u'a15dagib', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'db8fcff2-2c76-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-04-29 00:57:45{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'unblock'], u'account': u'a15dagib', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
N -N \ 32017-04-29 00:57:49{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'achhequq', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'achhequq', u'unblock'], u'account': u'achhequq', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-04-29 00:57:47{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'db8fcff2-2c76-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
μ P 3}2017-04-29 00:57:50{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'dd8f3b6c-2c76-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 00:57:49{u'message': {u'account': u'achhequq', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'achhequq', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'achhequq', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'dd8f3b6c-2c76-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
!
32017-04-29 00:57:54{u'message': {u'account': u'adsetd7p', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'adsetd7p', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'adsetd7p', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'e02ead44-2c76-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\ 32017-04-29 00:57:53{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'adsetd7p', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'adsetd7p', u'unblock'], u'account': u'adsetd7p', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
N -N \
32017-04-29 00:57:57{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'atozbfw7', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'atozbfw7', u'unblock'], u'account': u'atozbfw7', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-04-29 00:57:55{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'e02ead44-2c76-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
μ P 3}2017-04-29 00:57:58{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'e229defc-2c76-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 00:57:57{u'message': {u'account': u'atozbfw7', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'atozbfw7', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'atozbfw7', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'e229defc-2c76-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
!
32017-04-29 00:58:00{u'message': {u'account': u'peddlgdv', u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'peddlgdv', u'unblock'], u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'peddlgdv', u'block'], u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'e42efe62-2c76-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}\
32017-04-29 00:58:00{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'peddlgdv', u'block'], u'undo_action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'peddlgdv', u'unblock'], u'account': u'peddlgdv', u'abuse_type': u'compromised', u'undo_action': u'clamdscan_action', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 -Μ 6 32017-04-29 00:58:04{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'flank2uy', u'unblock'], u'account': u'flank2uy', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'e6435fe0-2c76-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^ 3
2017-04-29 00:58:03{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'flank2uy', u'unblock'], u'account': u'flank2uy', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-04-29 00:58:01{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'e42efe62-2c76-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
- - ^ 3
2017-04-29 00:58:05{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'uphos6w4', u'unblock'], u'account': u'uphos6w4', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}o 3
;2017-04-29 00:58:05{u'message': {'status': 'not done', 'parent_action_id': None, 'error_message': 'There were errors during execution - error message = iptables: Bad rule (does a matching rule exist in that chain?).\n , exit code = 1', 'action_id': 'e6435fe0-2c76-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 j 6 ^ 3
2017-04-29 00:58:07{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'fruitfei', u'unblock'], u'account': u'fruitfei', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}P 3}2017-04-29 00:58:07{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'e776c456-2c76-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 00:58:06{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'uphos6w4', u'unblock'], u'account': u'uphos6w4', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'e776c456-2c76-11e7-abbf-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
ψ j ψ o 3
;2017-04-29 00:58:09{u'message': {'status': 'not done', 'parent_action_id': None, 'error_message': 'There were errors during execution - error message = iptables: Bad rule (does a matching rule exist in that chain?).\n , exit code = 1', 'action_id': 'e8aa011c-2c76-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 00:58:08{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'fruitfei', u'unblock'], u'account': u'fruitfei', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'e8aa011c-2c76-11e7-8769-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 6 P 3}2017-04-29 02:15:37{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'bb282d12-2c81-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 02:15:36{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'unblock'], u'account': u'a15dagib', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'bb282d12-2c81-11e7-b975-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^ 3
2017-04-29 02:15:36{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'a15dagib', u'unblock'], u'account': u'a15dagib', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 6 P 3}2017-04-29 17:44:03{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': '6e78655e-2d03-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 17:44:02{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'achhequq', u'unblock'], u'account': u'achhequq', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': '6e78655e-2d03-11e7-9bb3-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^ 3
2017-04-29 17:44:01{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'achhequq', u'unblock'], u'account': u'achhequq', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}
6 6 P! 3}2017-04-29 18:44:18{u'message': {'status': 'done', 'parent_action_id': None, 'action_id': 'd90c0aa8-2d0b-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'} 32017-04-29 18:44:17{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'peddlgdv', u'unblock'], u'account': u'peddlgdv', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action', 'action_id': 'd90c0aa8-2d0b-11e7-81a7-0cc47aca427c'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}^ 3
2017-04-29 18:44:16{u'message': {u'action_params': [u'BAN_USER', u'eth1', u'80,443,465,587', u'peddlgdv', u'unblock'], u'account': u'peddlgdv', u'abuse_type': u'compromised', u'host_name': u'md-in-64.webhostbox.net', u'action_type': u'do', u'action': u'clamdscan_action'}, 'meta': {'sender_ip_address': '172.23.210.143'}, u'service': u'execute'}