Question

Given my following table structure:

I’m trying to build a query that will return the number of failed login attempts per IP since the last successful login of that same IP within the past hour.

For instance, you’ll notice there are several failed attempts (0) from a single IP within the past hour, but since the last successful login (#145) there has only been 1 (#146), which is what I want returned.

This query should also be dynamic and return rows of grouped IPs.

So far this is what I have, but I think @ipa is returning NULL

SELECT COUNT(*) tries, @ipa := login_ip
FROM login_log
WHERE login_id > (
    SELECT MAX(login_id)
    FROM login_log
    WHERE login_success = 1
    AND login_ip = @ipa
)
AND login_success = 0
AND login_date > NOW() - 3600
GROUP BY login_ip
ORDER BY tries DESC;

Thanks

Answer 1

Alias the table and try it this way, as your @ipa variable is doing nothing for you:

SELECT COUNT(1) tries, l.login_ip
FROM login_log l
WHERE login_id > (
    SELECT MAX(login_id)
    FROM login_log l2
    WHERE l2.login_success = 1
    AND l2.login_ip = l.login_ip
)
AND login_success = 0
AND login_date > NOW() - 3600
GROUP BY login_ip
ORDER BY tries DESC;

Additionally, you can do this with a join:

select
    count(1) tries,
    log1.login_ip
from
    login_log log1
    inner join (
        select
            login_ip,
            max(login_date) as max_date
        from
            login_log
        where
            login_success = 1
        group by
            login_ip
    ) log2 on
        log1.login_ip = log2.login_ip
where
    log1.login_success = 0
    and log1.login_date > NOW() - 3600
    and log1.login_date > log2.max_date
group by
    login_ip
order by tries desc

You can try both ways and see which one is faster for you.