Question

How would i find the number of attacks per day from the example log file? I’d like it to give a hint of anything that starts with a failed password.

I got most of the code but it needs work and am not quite sure been playing around with it for a few hours but have no luck.

$ myFile = open('auth','r')

#! /bin/python

att_dic = {}    
count_attack = 0
print 'Start of Debug messages'

for line in myFile.readlines():
    lineList2 = line.split(']')        
    att_list = lineList2[0]
    att_list2 = att_list.split('[')
    attack = att_list2[1]
    if att_dic.has_key(attack):
        count_attack = att_dic[attack]
        count_attack = count_attack +1
        att_dic[attack] = count_attack
        count_attack = 0
    else:
        att_dic[attack] = 1
    else:
        lineList2 = line.split(']')
        att_list = lineList2[1]
        att_list2 = att_list.split('[')
        attack = att_list2[0]

    if att_dic.has_key(attack):
        count_att = att_dic[ip]
        count_attack = count_att +1
        att_dic[attack] = count_attack
        count_attack =0
    else:
        att_dic[attack] = 1

    print attack        

print '\nEnd of Debug messages\n\n'
print 'Answers:\n'
print 'Number of attacks per day:'
for att_items in att_dic.keys():
print att_items ,' has', att_dic[att_items] , ' attacks per day '

Log File Sample

Jan 10 09:32:07 j4-be03 sshd[3876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.173.35  user=root   
Jan 10 09:32:09 j4-be03 sshd[3876]: Failed password for root from 218.241.173.35 port 47084 ssh2
Jan 10 09:32:17 j4-be03 sshd[3879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.173.35  user=root
Jan 10 09:32:19 j4-be03 sshd[3879]: Failed password for root from 218.241.173.35 port 47901 ssh2

Answer 1

I done it i used a dict and a count found the days and counted the number of attack per day.
thanks for your help anyway