Friday, 10 October 2012 13:15:39 +0300|192.168.110.5|rock| - |user has made auth in| -
Friday, 10 October 2012 13:15:39 +0300|192.168.110.5|rock| - |user has changed password| -
Friday, 10 October 2012 13:15:39 +0300|192.168.110.5|rock| - |user has made auth off| -
Friday, 10 October 2012 13:15:42 +0300|192.168.110.5|hogan| - |user has made auth in| -
Friday, 10 October 2012 13:15:49 +0300|172.16.170.180|cena| - |user has made auth in| -
Friday, 10 October 2012 13:15:49 +0300|172.16.170.180|cena| - |user has changed password| -
Friday, 10 October 2012 13:15:49 +0300|172.16.170.180|cena| - |user has made auth off| -
Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has made auth in| -
Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has made auth in| -
Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has changed password| -
Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has made auth off| -
Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has made auth in| -
Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has changed password| -
Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has changed profile| -
Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has made auth off| -
Friday, 10 October 2012 13:19:19 +0300|10.10.10.25|ziggler| - |user has made auth in| -
Friday, 10 October 2012 13:19:19 +0300|10.10.10.25|ziggler| - |user has changed password| -
Friday, 10 October 2012 13:19:19 +0300|10.10.10.25|ziggler| - |user has made auth off| -
Friday, 10 October 2012 13:20:42 +0300|178.57.67.225|vince| - |user has made auth in| -

#!/bin/bash

log=/root/auth.log
temp=/root/log.temp
result=/root/bots.result

cat /dev/null > $temp
cat /dev/null > $result

cat $log | awk '{print $6}' | awk -F "|" '{print $2}' | tail -n 10 > $temp

for i in `uniq -c $temp | awk '{print $1}'`; do
if [ $i -gt 4 ]; then
a=`uniq -c $temp | awk '$1 == '$i`
echo "This is a boy: $a" >> $result
fi
done

#!/bin/bash
log="/root/auth.log"
result="/root/bots.result"

# we probably don't need the intermediate file
# temp=/root/log.temp

# a simple redirect can clear the output file
> $result

# read every line of the log file
while read line; do
   # split fields with 'cut' using whitespace as a delimiter
   date=`echo "$line" | cut -d' ' -f1-5`

   # split using pipe as a delimiter
   ip=`echo "$line" | cut -d'|' -f2`
   user=`echo "$line" | cut -d'|' -f3`
   event=`echo "$line" | cut -d'|' -f5`

   # report results
   echo "date:$date user:$user from ip:$ip $event" >> "$results"
done < "$log"