Phoenix Network Forums

Just got here and figured I would show this perl script I made that would be useful for parsing your ssh logs.

Usage:

Code: Select all

root@localhost:/home/tgo/perl# perl log.pl
------- Report for 192.168.1.100 -----------
Total Entries: 11
Accepted Logins: 7
Failed Logins: 4
------- Report for 68.28.145.143 -----------
Total Entries: 4
Accepted Logins: 3
Failed Logins: 1
------- Report for 24.88.182.160 -----------
Total Entries: 1
Accepted Logins: 1
Failed Logins: 0
root@localhost:/home/tgo/perl#


Code:

Code: Select all

#!/usr/bin/perl

# /var/log/messages parser coded by tgo
# http://www.anomalous-security.org

use warnings;

open(F,"/var/log/messages") or die($!);

my %ips;

while(<F>)
{
   if (($ip) = /(\d+\.\d+\.\d+\.\d+)/)
   {
      if (/Accepted/)
      {
      $action = "accepted";
      }   
      elsif(/Failed password/)
      {
      $action = "failed";      
      }
      else
      {
      next;
      }

      if (defined($ips{$ip}{$action}))
      {
      $ips{$ip}{$action}++;
      }
      else
      {
      $ips{$ip}{$action} = 1;
      }            
   }
}

close(F);

for my $ip ( keys %ips )
{
   $ips{$ip}{'accepted'} = 0 unless (defined($ips{$ip}{'accepted'}));
   $ips{$ip}{'failed'} = 0 unless (defined($ips{$ip}{'failed'}));

   $total = $ips{$ip}{'accepted'} + $ips{$ip}{'failed'};

   print "------- Report for $ip -----------\n";
   print "Total Entries: " . $total . "\n";
   print "Accepted Logins: " . $ips{$ip}{'accepted'} . "\n";
   print "Failed Logins: " . $ips{$ip}{'failed'} . "\n";
}