LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices



Reply
 
Search this Thread
Old 01-04-2013, 09:07 AM   #1
johnmccarthy
Member
 
Registered: Jul 2010
Posts: 56

Rep: Reputation: 1
Smile How do I grep my /var/log/secure file for the past 7 days or so many days?


New to linux (RHEL 5) and wondered I do I grep against my /var/log/secure file to extract the last 7 days or so many days? I've read on the net how to extract a certain date range (example 1 through 15 December) but it would be to much trouble to keep entering the range when I can just get the last weeks (or more) of data. A million thanks,
Johnny Mac

Below is a part of my /var/log/secure log.

Sep 7 08:34:25 myhost sshd[6127]: Failed password for illegal user root from 62.75.999.999 port 52663 ssh2
Sep 7 08:34:26 myhost sshd[7253]: User root not allowed because listed in DenyUsers
Sep 7 08:34:28 myhost sshd[7253]: Failed password for illegal user root from 62.75.999.999 port 53393 ssh2
Sep 7 11:55:18 myhost sshd[11672]: Accepted password for gooduser from 98.999.26.41 port 43104 ssh2
Sep 7 23:01:28 myhost sshd[22438]: Did not receive identification string from 999.56.32.999
Sep 8 06:31:30 myhost sshd[21814]: Accepted password for gooduser from 98.999.26.41 port 5978 ssh2
 
Old 01-04-2013, 09:20 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
well secure should be being rotated weekly if not daily. so they should already be in a limited timescale already. On a well managed system, each day /var/log/secure will be compressed at 4am, to secure.1.gz, and a new file created.

as for grepping things regardless, you just need to craft a text string which suits what you want, e.g.
Code:
grep 'Sep [4-6]' /var/log/secure
Learn regular expressions, the world is your oyster!
 
Old 01-04-2013, 11:48 AM   #3
johnmccarthy
Member
 
Registered: Jul 2010
Posts: 56

Original Poster
Rep: Reputation: 1
Smile Rotate Monthly

I rotate monthly which is why I was wondering if I could extrapulate based on a time-frame not date.
 
Old 01-04-2013, 11:56 AM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,494

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
Code:
date -d "last week"
 
1 members found this post helpful.
Old 01-04-2013, 05:57 PM   #5
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968Reputation: 1968
Quote:
Originally Posted by johnmccarthy View Post
I rotate monthly which is why I was wondering if I could extrapulate based on a time-frame not date.
so no, you can't do it on a timeframe, you need to treat it all as text in grep.
 
Old 01-04-2013, 10:43 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,725
Blog Entries: 54

Rep: Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970Reputation: 2970
Quote:
Originally Posted by johnmccarthy View Post
New to linux (RHEL 5) and wondered I do I grep against my /var/log/secure file to extract the last 7 days or so many days?
Code:
# Use like 'greprange 14 /var/log/secure':
greprange() { for ((i="$1";i>0;i--)); do grep $(date --date="$i days ago" +'^%b %e.*sshd') "$2"; done; }

Quote:
Originally Posted by johnmccarthy View Post
[code]
Sep 7 08:34:25 myhost sshd[6127]: Failed password for illegal user root from 62.75.999.999 port 52663 ssh2
Sep 7 08:34:26 myhost sshd[7253]: User root not allowed because listed in DenyUsers[code]
If this is about reporting also see Logwatch.
If this is about countering brute force logins see fail2ban.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how to get free memory stat for the past few days alirz Linux - Newbie 6 07-05-2011 10:47 AM
sar output for the past 4 days ZAMO Linux - Enterprise 2 12-24-2008 06:00 PM
NFS errors for the past few days dougtheslug Linux - Server 14 03-12-2008 02:06 PM
fc4 no. 8 on most downloads in past 30 days???? bendeco13 Linux - Software 5 08-22-2007 05:45 PM
Been trying to install Red Hat 7.0 for the past 3 days w/o success, HELP!!! jayman626 Linux - Software 6 07-16-2001 03:55 AM


All times are GMT -5. The time now is 08:55 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration