Parsing secure/auth logs for failed SSH attempts
by sudo on Apr.01, 2009, under Linux
grep "Failed password for invalid user" /var/log/secure | awk '{ print $13 }' | sort | uniq -c | sort -rn
These will only parse for failed users other than root. Will display which IPs failed authentication and how many times in descending order.
The following will work for root.
grep "Failed password for root" /var/log/secure | awk '{ print $11 }' | sort | uniq -c | sort -rn
And for valid users.
grep "Failed password for " /var/log/secure | egrep -v "invalid|root" | awk '{ print $11 }' | sort | uniq -c | sort -rn
