Posted By

_reydin_ on 07/04/12

Tagged

Bash

Versions (?)

Last Edited at 07/04/12 01:16am

Statistics

Viewed 997 times

Favorited by 1 user(s)

Related snippets

Linux auth.log parser

/ Published in: Bash

This script will parse the auth.log and return results depending on the argument entered. To run the script enter one of the following.
./auth success or ./auth fail

Highlighted TextExpand

#!/bin/bash

auth=/var/log/auth.log

if [ "$1" != "" ]; then  #check that there is an argument

if [ "$1" = success ]; then     #check the entered argument for success
                for i in `grep Accepted ${auth} | cut -d: -f3 | cut -c18-23`  #search and cut the session id
                do

id=$i
                user=`grep Accepted ${auth} | grep ${id} | cut -d: -f4 | cut -d' ' -f5`
                month=`grep Accepted ${auth} | grep ${id} | cut -d" " -f1`
                day=`grep Accepted ${auth} | grep ${id} | cut -c4-6 | cut -c1-3`
                atime=`grep Accepted ${auth} | grep ${id} | cut -c7-15`

echo "Status: [success] Account name: $user  Date:$month,$day,$atime"

done

elif [ "$1" = fail ]; then      #check the entered argument for fail

for i in `grep Failed ${auth} | grep password | cut -c8-15` #search and cut the time
                do

id=$i
                user=`grep Failed ${auth} | grep ${id} | grep password | cut -d: -f4 | cut -d" " -f5`
                month=`grep Failed ${auth} | grep ${id} | grep password | cut -c1-3`
                day=`grep Failed ${auth} | grep ${id} | grep password | cut -c4-6`
                #atime=`grep Failed ${auth} | grep ${id} | cut -d" " -f3`
                atime=$i

echo "Status: [fail] Account name: $user  Date: $month, $day, $atime"

done

else    #if more than one argument is entered or it doesn't match fail or success exit
        exit 0
        fi

else
        echo "Example: ./auth.sh [success | fail]"  #if there is no argument entered show example
        exit 0
fi

Report this snippet Tweet

Comments

Subscribe to comments

Comment:

You need to login to post a comment.