Skip to main content
4 of 4
added 43 characters in body; edited title
JigglyNaga
  • 8.1k
  • 1
  • 27
  • 48

How to retrieve counts of IP addresses from log file?

I am checking a log file to retrieve ip adresses plus how many times a log failed. This is what my log file looks like:

Feb  2 15:20:02 tank sshd[14870]: Failed password for root from 143.100.67.173 port 13356 ssh2
Feb  2 15:20:07 tank sshd[14874]: Failed password for root from 143.100.67.173 port 30595 ssh2
Feb  2 15:20:12 tank sshd[14874]: Failed password for root from 143.100.67.173 port 30595 ssh2
Feb  2 15:20:16 tank sshd[14874]: Failed password for root from 143.100.67.173 port 30595 ssh2
Feb  2 15:20:20 tank sshd[14874]: Failed password for root from 143.100.67.173 port 30595 ssh2
Feb  2 15:20:23 tank sshd[14874]: Accepted password for root from 143.100.67.173 

Now, I want to also check for how many times the log was accepted. The idea is to get an overview over brute forcing attacks.

How do I extend

sed -nr '/Failed/{s/.*([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/;p}'| sort | uniq -c 

to also check for accepted passwords? Something like

sed -nr '/Accepted|Failed/{s/.*([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/;p}'| sort | uniq -c 

But instead of having an "or" between Accepted and Failed I would like to get a count result that would look like this:

123.53.163.22 3 2

(The columns are: IP address, total Failed, total Accepted)

This is related to How to retrieve IP addresses of possible ssh attackers?