Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Friday, 10 October 2012 13:15:39 +0300|192.168.110.5|rock| - |user has made auth in| -
- Friday, 10 October 2012 13:15:39 +0300|192.168.110.5|rock| - |user has changed password| -
- Friday, 10 October 2012 13:15:39 +0300|192.168.110.5|rock| - |user has made auth off| -
- Friday, 10 October 2012 13:15:42 +0300|192.168.110.5|hogan| - |user has made auth in| -
- Friday, 10 October 2012 13:15:49 +0300|172.16.170.180|cena| - |user has made auth in| -
- Friday, 10 October 2012 13:15:49 +0300|172.16.170.180|cena| - |user has changed password| -
- Friday, 10 October 2012 13:15:49 +0300|172.16.170.180|cena| - |user has made auth off| -
- Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has made auth in| -
- Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has made auth in| -
- Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has changed password| -
- Friday, 10 October 2012 13:15:59 +0300|192.168.107.1|master| - |user has made auth off| -
- Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has made auth in| -
- Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has changed password| -
- Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has changed profile| -
- Friday, 10 October 2012 13:17:50 +0300|192.168.107.1|cmpunk| - |user has made auth off| -
- Friday, 10 October 2012 13:19:19 +0300|10.10.10.25|ziggler| - |user has made auth in| -
- Friday, 10 October 2012 13:19:19 +0300|10.10.10.25|ziggler| - |user has changed password| -
- Friday, 10 October 2012 13:19:19 +0300|10.10.10.25|ziggler| - |user has made auth off| -
- Friday, 10 October 2012 13:20:42 +0300|178.57.67.225|vince| - |user has made auth in| -
- #!/bin/bash
- log=/root/auth.log
- temp=/root/log.temp
- result=/root/bots.result
- cat /dev/null > $temp
- cat /dev/null > $result
- cat $log | awk '{print $6}' | awk -F "|" '{print $2}' | tail -n 10 > $temp
- for i in `uniq -c $temp | awk '{print $1}'`; do
- if [ $i -gt 4 ]; then
- a=`uniq -c $temp | awk '$1 == '$i`
- echo "This is a boy: $a" >> $result
- fi
- done
- #!/bin/bash
- log="/root/auth.log"
- result="/root/bots.result"
- # we probably don't need the intermediate file
- # temp=/root/log.temp
- # a simple redirect can clear the output file
- > $result
- # read every line of the log file
- while read line; do
- # split fields with 'cut' using whitespace as a delimiter
- date=`echo "$line" | cut -d' ' -f1-5`
- # split using pipe as a delimiter
- ip=`echo "$line" | cut -d'|' -f2`
- user=`echo "$line" | cut -d'|' -f3`
- event=`echo "$line" | cut -d'|' -f5`
- # report results
- echo "date:$date user:$user from ip:$ip $event" >> "$results"
- done < "$log"
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement