How to manipulate log file using grep or awk?

Question

I'm trying to get over the /var/log/secure log file, and show only the "Failed Password" log type, which appear at least 3 times.. There is any way to do that using linux commands only? awk? grep?

An example for secure log,

Mar 20 08:38:28 localhost sshd[21895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net user=root 
Mar 20 08:38:31 localhost sshd[21895]: Failed password for root from 207.210.101.209 port 2854 ssh2 
Mar 20 15:38:31 localhost sshd[21896]: Received disconnect from 207.210.101.209: 11: Bye Bye 
Mar 20 08:38:32 localhost unix_chkpwd[21900]: password check failed for user (root) 
Mar 20 08:38:32 localhost sshd[21898]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=she

from this log file I expect say nothing because there is only 1 Failed Password line, but lets say there were 4 lines of "Failed Password", with the same IP - I want to display the IP address which probably trying to brute force me..

Answer 1

This is just a way to do the job. Instead of username, I prefer count how many times a specific IP address try to connect to my host, because then I can eventually ban it.

awk '/Failed password/{ z[$11]++; } 
     END{ 
       for (i in z){ 
         if (z[i]>3) printf("%s attemps %s times.\n", i, z[i])
       }
}' /var/log/secure

(Of course it can be a oneliner command, I indented to increase readability.)

Explanation:

awk reads the log file line by line. If a line contain the string /Failed password/ increment an array element z[$11]++ index by $11 (i.e. the IP address): I use this as a counter. At the end, search in the array z[$11] and print only the IP addresses that have tried to connect more than 3 times.
You can customize the check and the print message as you like.

---

If your concern are the brute-force attempts, may I suggest you to use an existing tool as Fail2ban which scans log files and bans IPs that show the malicious signs (for examples: too many password failures, seeking for exploits, etc..). It's easy to understand and configure to fit your needs.

Answer 2

$ awk '/Failed password/{for(i=1;i<=NF;i++)if($i~/for/)user[$(i+1)]++}END{for(j in user){if(user[j]>3){printf("%s : %s times failed\n",j,user[j])}}}' /var/log/secure