/var/log/messages parser

tgo · 12-07-2005, 11:14 PM

Here is a little script to parse /var/log/messages. If you run sshd on port 22 you know how many times you get bruteforced by zombies and this should make parsing the logs easier.

The code should be pretty easy to read and understand so i didnt comment anything.

Usage:

Code:

root@blackdragon:/home/tgo/perl# perl log.pl
------- Report for 127.0.0.1 -----------
Total Entries: 1
Accepted Logins: 0
Failed Logins: 1
------- Report for 192.168.1.100 -----------
Total Entries: 6
Accepted Logins: 6
Failed Logins: 0
root@blackdragon:/home/tgo/perl#

Code:

#!/usr/bin/perl

# /var/log/messages parser coded by tgo
# http://www.anomalous-security.org

use warnings;

open(F,"/var/log/messages") or die($!);

my %ips;

while(<F>)
{
	if ($_ =~ /(\d+\.\d+\.\d+\.\d+)/)
	{
		$ip = $1;	
	
		if ($_ =~ /Accepted/)
		{
		$action = "accepted";
		}	
		elsif($_ =~ /Failed password/)
		{
		$action = "failed";		
		}
		else
		{
		next;
		}

		if (defined($ips{$ip}{$action}))
		{
		$ips{$ip}{$action} = $ips{$ip}{$action} + 1;
		}
		else
		{
		$ips{$ip}{$action} = 1;
		}				
	}
}

close(F);

for my $ip ( keys %ips )
{
	$ips{$ip}{'accepted'} = 0 unless (defined($ips{$ip}{'accepted'}));
	$ips{$ip}{'failed'} = 0 unless (defined($ips{$ip}{'failed'}));

	$total = $ips{$ip}{'accepted'} + $ips{$ip}{'failed'};

	print "------- Report for $ip -----------\n";
	print "Total Entries: " . $total . "\n";
	print "Accepted Logins: " . $ips{$ip}{'accepted'} . "\n";
	print "Failed Logins: " . $ips{$ip}{'failed'} . "\n";
}

**LoneWolf071** · 12-08-2005, 11:12 AM

they Make, At Least For Debian, An Auto-script that will do that for you, it's called log rotate... check it out... it's really good software...

12-08-2005, 11:12 AM	#2 (permalink)
LoneWolf071 Be Free Join Date: Nov 2004 Location: Texas Posts: 840 OS: Windows XP, Linux	they Make, At Least For Debian, An Auto-script that will do that for you, it's called log rotate... check it out... it's really good software... __________________ Suicide Command in Linux : rm -rf / ;) AIM:TheLoneWolf071@aim.com--If You Need Help, Don't Hesitate...