linux - Echo results from a grep search in shell script -
i have shell script searches authentication fails. example if given file contains following row:
mar 19 15:54:18 precise3 sshd[16516]: failed password lotte 127.0.0.1 port 47384 ssh2
the shell script find , write results in separate file as:
date: date username: username client ip: ip-address
now have script finds authentication fails, how can write data fail file? script is:
#!/bin/bash if egrep "sshd\[[0-9]+\]: failed password \w+ [0-9.]+ port [0-9]+ ssh2$" /var/log/auth.log echo "date: date username: username client ip: ip-address" > /root/failedauth else echo "no failed authentications found." fi
using awk:
awk '/failed password/ {print "date: "$1" "$2" "$3"\tusername: "$9"\t\tclient ip: "$11 }' /var/log/auth.log >> /root/failedauth
the above find failed auth attempts , log them in /root/failedauth - if want line echoed if there no results, like:
failures=$(awk '/failed password/ {print "date: "$1" "$2" "$3"\tusername: "$9"\t\tclient ip: "$11 }' /var/log/auth.log) test -n "$failures" && echo "$failures" >> /root/failedauth || echo "no failed auths found"
Comments
Post a Comment