but auth.log is a very large and blinding file... so:
cat /var/log/auth.log | egrep -e "\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b" | cut -d":" -f4 | uniq | sed 's/[a-zA-Z\-]//g' | awk '{print $1}' | uniq
obviously a script is a smarter solution ;D
links: authCheck
No comments :
Post a Comment