Get list of IP addresses that have failed to login to SSH from the /var/log/auth.log SSHD log.

gistfile1.txt

A method for getting a list of IP addresses that failed to login to SSH from the /var/log/auth.log.

For just failed root login attempts:
grep "Failed password for root from" /var/log/auth.log | cut -d " " -f 11 | sort | uniq -c

For invalid user failed login attempts:
grep "Failed password for invalid user" /var/log/auth.log | cut -d " " -f 13 | sort | uniq -c