script to keep 'count' of failed login attempts

hattori.hanzo · 04-02-2008, 12:33 AM

I need to keep a running tally/count of all failed attempts are logged to my /var/log/secure file.

A simple bash script/commands like 'cat /var/log/secure | grep Failed | wc -l' will show me the count. This will work fine for 1 week, until my logs are rotated.

I am looking for a more elegant way, maybe run a script via cron and keep an incrementing counter. Everytime the script runs, it checks the counter and increments accordingly even after the logs are rotated.

regards

Tinkster · 04-02-2008, 05:02 PM

Easy?
Read the count from a count-file.
Grep secure.
Add found new failures to original ones.
Write the count-file back with the updated value.

Or, even more simple:

Code:

grep Failed /var/log/secure >> failures.tmp
mv failures failures.tmp2
cat failures.* | sort -u > failures
wc -l failures

Cheers,
Tink

hattori.hanzo · 04-02-2008, 07:39 PM

Thanks. I tried it but kept getting doubled up counts.

I have decided to compromise and just grepping secure* on a daily basis. This way I also dont need to mess with logrotate.

Not elegant but it works until my scripting improves.

Code:

#!/bin/bash
#
# grep 'Failed' /var/log/secure* logs and count
grep Failed /var/log/secure* | wc -l > failed.txt
# mail results
cat failed.txt | mail -s "Failed count" peter.piper@mail.com

regards

konsolebox · 04-02-2008, 07:41 PM

I'm not sure if this will work with locked files but please just try it

Code:

# (a) [secure] = [secure.latest]
ln /var/log/secure /var/log/secure.latest -f

# (b) [secure.new], [secure] = [secure.latest]
: > /var/log/secure.new
chown --reference=/var/log/secure /var/log/secure.new
chmod --reference=/var/log/secure /var/log/secure.new

# (c) [secure] = [secure.new], [secure.latest]
ln /var/log/secure.new /var/log/secure -f

# (d) [secure], [secure.latest]
unlink /var/log/secure.new

# (e) process [secure.latest]
[ -e /var/log/secure.count ] && count=$(</var/log/secure.count)
(( count += $(grep -c Failed /var/log/secure.latest) ))
echo "${count}" > /var/log/secure.count

# (f) delete [secure.latest]
rm /var/log/secure.latest

edit: btw it's only about the count right? tell me if you still want the logs

Tinkster · 04-02-2008, 08:12 PM

Quote:

Originally Posted by hattori.hanzo

Thanks. I tried it but kept getting doubled up counts.

Are you saying sort -u isn't working? Btw, I had a little faux-pas
in my code block. It should have been a > instead of a >>, but sort -u
should take care of that anyway.

Cheers,
Tink

hattori.hanzo · 04-02-2008, 09:46 PM

Quote:

Originally Posted by Tinkster

Are you saying sort -u isn't working?

It works fine but I don't understand why we need 'sort -u' if I only need the count which 'wc -l' takes care of.

Code:

#!/bin/bash
#
grep Failed /var/log/secure >> ./tmp/failures.tmp
mv ./tmp/failures ./tmp/failures.tmp2
cat ./tmp/failures.* | sort -u >> ./tmp/failures
cat ./tmp/failures | wc -l > ./tmp/failures.txt
#
#mail results
cat ./tmp/failures.txt | mail -s "Failed count 2" peter.piper@mail.com

regards

Tinkster · 04-02-2008, 10:10 PM

Because you get duplicate lines otherwise if the log isn't rotated daily,
but you run the count every day.

Cheers,
Tink

hattori.hanzo · 04-02-2008, 10:23 PM

Quote:

Originally Posted by Tinkster

Because you get duplicate lines otherwise if the log isn't rotated daily,
but you run the count every day.

Thank you for the explanation.

Just did a double take: sort with the -u flag does a unique sort. Learn a new thing every day!