Parsing log

Checking the number of login attempts coming from an ip

Checking the number of login attempts coming from an ip:

debian/ubuntu:
    cat /var/log/auth.log | grep -o '[0-9]\{0,3\}\.[0-9]\{0,3\}\.[0-9]\{0,3\}\.[0-9]\{0,3\}' | cut -d " " -f 1 | sort | uniq -c | sort -unr

rhel/centos:
    cat /var/log/secure | grep -o '[0-9]\{0,3\}\.[0-9]\{0,3\}\.[0-9]\{0,3\}\.[0-9]\{0,3\}' | cut -d " " -f 1 | sort | uniq -c | sort -unr

Dropping ip attacker with iptables:
    iptables -I INPUT -s IPATTACKER -j DROP && service iptables restart && clear; iptables -L