security - auth.log parse

how to check auth.log easly

marek@bunny:~$ uptime
 20:44:25 up  6:08,  2 users,  load average: 0.00, 0.00, 0.00

marek@bunny:~$ for i in `sudo grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" /var/log/auth.log  | sort | uniq | grep -v 0.0.0.0`; do geoiplookup $i; done

GeoIP Country Edition: VN, Vietnam
GeoIP Country Edition: US, United States
GeoIP Country Edition: DZ, Algeria
GeoIP Country Edition: MU, Mauritius
GeoIP Country Edition: DZ, Algeria
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: KR, Korea, Republic of
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: BR, Brazil
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: IR, Iran, Islamic Republic of
GeoIP Country Edition: EG, Egypt
GeoIP Country Edition: IT, Italy
GeoIP Country Edition: IP Address not found
GeoIP Country Edition: US, United States
GeoIP Country Edition: TR, Turkey
GeoIP Country Edition: ES, Spain
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: CN, China
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: IR, Iran, Islamic Republic of
GeoIP Country Edition: RO, Romania
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: PE, Peru
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: UA, Ukraine
GeoIP Country Edition: GB, United Kingdom
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: MA, Morocco
GeoIP Country Edition: CL, Chile
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: AR, Argentina
GeoIP Country Edition: IT, Italy
GeoIP Country Edition: PL, Poland
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: PL, Poland
GeoIP Country Edition: US, United States
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: CN, China
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: CN, China
GeoIP Country Edition: IT, Italy
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: RU, Russian Federation
GeoIP Country Edition: CZ, Czech Republic
GeoIP Country Edition: RU, Russian Federation


how to count this sinners?


marek@bunny:~$ cat ip_tst.txt | sort | uniq | xargs -n 1 geoiplookup { } | sort | uniq -c | sort
     12 GeoIP Country Edition: AR, Argentina
      1 GeoIP Country Edition: BR, Brazil
      1 GeoIP Country Edition: CL, Chile
      1 GeoIP Country Edition: CZ, Czech Republic
      1 GeoIP Country Edition: EG, Egypt
      1 GeoIP Country Edition: ES, Spain
      1 GeoIP Country Edition: GB, United Kingdom
      1 GeoIP Country Edition: IP Address not found
      1 GeoIP Country Edition: KR, Korea, Republic of
      1 GeoIP Country Edition: MA, Morocco
      1 GeoIP Country Edition: MU, Mauritius
      1 GeoIP Country Edition: PE, Peru
      1 GeoIP Country Edition: RO, Romania
      1 GeoIP Country Edition: TR, Turkey
      1 GeoIP Country Edition: UA, Ukraine
      1 GeoIP Country Edition: VN, Vietnam
     27 GeoIP Country Edition: CN, China
      2 GeoIP Country Edition: DZ, Algeria
      2 GeoIP Country Edition: IR, Iran, Islamic Republic of
      2 GeoIP Country Edition: PL, Poland
      3 GeoIP Country Edition: IT, Italy
      3 GeoIP Country Edition: US, United States
      9 GeoIP Country Edition: RU, Russian Federation