How do I grep my /var/log/secure file for the past 7 days or so many days?

johnmccarthy · 01-04-2013, 08:07 AM

New to linux (RHEL 5) and wondered I do I grep against my /var/log/secure file to extract the last 7 days or so many days? I've read on the net how to extract a certain date range (example 1 through 15 December) but it would be to much trouble to keep entering the range when I can just get the last weeks (or more) of data. A million thanks,
Johnny Mac

Below is a part of my /var/log/secure log.

Sep 7 08:34:25 myhost sshd[6127]: Failed password for illegal user root from 62.75.999.999 port 52663 ssh2
Sep 7 08:34:26 myhost sshd[7253]: User root not allowed because listed in DenyUsers
Sep 7 08:34:28 myhost sshd[7253]: Failed password for illegal user root from 62.75.999.999 port 53393 ssh2
Sep 7 11:55:18 myhost sshd[11672]: Accepted password for gooduser from 98.999.26.41 port 43104 ssh2
Sep 7 23:01:28 myhost sshd[22438]: Did not receive identification string from 999.56.32.999
Sep 8 06:31:30 myhost sshd[21814]: Accepted password for gooduser from 98.999.26.41 port 5978 ssh2

acid_kewpie · 01-04-2013, 08:20 AM

well secure should be being rotated weekly if not daily. so they should already be in a limited timescale already. On a well managed system, each day /var/log/secure will be compressed at 4am, to secure.1.gz, and a new file created.

as for grepping things regardless, you just need to craft a text string which suits what you want, e.g.

Code:

grep 'Sep [4-6]' /var/log/secure

Learn regular expressions, the world is your oyster!

johnmccarthy · 01-04-2013, 10:48 AM

I rotate monthly which is why I was wondering if I could extrapulate based on a time-frame not date.

syg00 · 01-04-2013, 10:56 AM

Code:

date -d "last week"

acid_kewpie · 01-04-2013, 04:57 PM

Quote:

Originally Posted by johnmccarthy

I rotate monthly which is why I was wondering if I could extrapulate based on a time-frame not date.

so no, you can't do it on a timeframe, you need to treat it all as text in grep.

unSpawn · 01-04-2013, 09:43 PM

Quote:

Originally Posted by johnmccarthy

New to linux (RHEL 5) and wondered I do I grep against my /var/log/secure file to extract the last 7 days or so many days?

Code:

# Use like 'greprange 14 /var/log/secure':
greprange() { for ((i="$1";i>0;i--)); do grep $(date --date="$i days ago" +'^%b %e.*sshd') "$2"; done; }

Quote:

Originally Posted by johnmccarthy

[code]
Sep 7 08:34:25 myhost sshd[6127]: Failed password for illegal user root from 62.75.999.999 port 52663 ssh2
Sep 7 08:34:26 myhost sshd[7253]: User root not allowed because listed in DenyUsers[code]

If this is about reporting also see Logwatch.
If this is about countering brute force logins see fail2ban.