Analizando logs

By 2 de julio de 2009 CentoOS, Linux, Red Hat No Comments

Un pequeño apunte para sacar datos de /var/log/secure

En este caso un listado de ataques a uno de los servidores.

[email protected] [~]#  cat /var/log/secure | grep Failed | cut -d: -f7 | cut -d' ' -f1 | sort| uniq -c
 8 148.228.20.240
 5 190.196.23.163
 8 200.164.76.166
 8 200.234.201.121
 12 202.103.25.132
 6 61.37.158.250
 11 77.51.250.130
 3 80.108.210.147

[email protected] [~]#  netstat -np | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | awk '{if ($1>2){print $0}}'
 49
 16 127.0.0.1
 19 DGRAM
 70 STREAM

Leave a Reply

Your email address will not be published.