Not always we need complicated graphing tool. Indeed on Command Line, one liner commands are often more powerful especially when a server is under attack. This Guide SSH Commands For Fail2Ban Log Analysis Shows Some One Liner Complex Commands For Quick Analysis Works Like Grouping & Sorting IPs. Actually previously we have shown a graphing way for Fail2Ban log analysis badip.com. Obviously, this kind of guides are self reminder too. We are talking about the below screenshot like analysis :
SSH Commands For Fail2Ban Log Analysis
For some commands, you need to have GeoIP (like we installed and configured for Nginx GeoIP). Otherwise you need no extra software installed. Normally, the log is at /var/log/fail2ban.log. We can have two types of log file format :
1 2 3 4 5 6 7 | fail2ban.log fail2ban.log.1 fail2ban.log.2 fail2ban.log.1.gz fail2ban.log.2.gz fail2ban.log.3.gz fail2ban.log.4.gz |
Old files will be in gzip format. For that reason, we have made a pair of commands for each type of report except for the command for instant check everyday.
---
Find the number of attacks by each IP
This command is very useful for checking Fail2Ban everyday, it divides in to number, possible host name and IP address :
1 | grep "Ban " /var/log/fail2ban.log | grep `date +%Y-%m-%d` | awk '{print $NF}' | sort | awk '{print $1,"("$1")"}' | logresolve | uniq -c | sort |
Example output :
1 2 3 4 5 6 7 8 9 10 11 | 1 181.48.143.50 (181.48.143.50) 1 host-81-162-59-42.dynamic-pool.bospor-telecom.net (81.162.59.42) 1 localhost (123.31.34.164) 1 r167-58-2-61.dialup.adsl.anteldata.net.uy (167.58.2.61) 3 113.105.211.130.bc.googleusercontent.com (130.211.105.113) 3 116.31.116.50 (116.31.116.50) 3 124.30.65.218.broad.xy.jx.dynamic.163data.com.cn (218.65.30.124) 3 localhost (117.1.246.223) 3 localhost (123.31.31.63) 3 localhost (123.31.31.67) 3 saargo.com.mx (187.141.70.67) |
This command shows the number of attacker IPs for the non gzip Fail2Ban logs :
1 | grep -h "Ban " /var/log/fail2ban.log* | awk '{print $NF}' | sort | uniq -c |
Example output :
1 2 3 4 5 6 7 8 9 10 11 | 334 116.31.116.50 398 117.1.246.223 341 123.31.31.63 367 123.31.31.67 186 123.31.34.164 35 130.211.105.113 197 167.58.2.61 10 181.48.143.50 36 187.141.70.67 3 218.65.30.124 1 81.162.59.42 |
Find the number of attacker countries
This command shows the number of banned attacker IPs with country for the both gzip & non-gzip Fail2Ban logs :
1 | zgrep -h "Ban " /var/log/fail2ban.log* | awk '{print $NF}' | sort | uniq -c | xargs -n 1 geoiplookup { } | sort | uniq -c | sort |
Example output :
1 2 3 4 5 6 7 8 | 11 GeoIP Country Edition: IP Address not found 1 GeoIP Country Edition: CO, Colombia 1 GeoIP Country Edition: MX, Mexico 1 GeoIP Country Edition: UA, Ukraine 1 GeoIP Country Edition: US, United States 1 GeoIP Country Edition: UY, Uruguay 2 GeoIP Country Edition: CN, China 4 GeoIP Country Edition: VN, Vietnam |
If you want the above command get rid of GeoIP Country Edition: then run this :
1 | zgrep -h "Ban " /var/log/fail2ban.log* | awk '{print $NF}' | sort | uniq -c | xargs -n 1 geoiplookup { } | sort | uniq -c | sort | sed -r 's/ GeoIP Country Edition://g' |
Example output :
1 2 3 4 5 6 7 8 | 12 IP Address not found 1 CO, Colombia 1 MX, Mexico 1 UA, Ukraine 1 US, United States 1 UY, Uruguay 3 CN, China 4 VN, Vietnam |
Others
This command is for checking Fail2Ban everyday who are Unbanned :
1 | grep "Unban " /var/log/fail2ban.log | grep `date +%Y-%m-%d` | awk '{print $NF}' | sort | awk '{print $1,"("$1")"}' | logresolve | uniq -c | sort |
This command is for checking of how many instances of set of actions are taken for a jail like SSHD :
1 | grep -h "sshd " /var/log/fail2ban.log | awk '{print $NF}' | sort | uniq -c |
This command shows the number of attacks with month name and date for the non gzip authentication logs :
1 | cat /var/log/auth.log* | grep 'Failed password' | grep sshd | awk '{print $1,$2}' | sort | uniq -c |
This command shows number of attacks with month name and date for gzip authentication logs :
1 | zcat /var/log/auth.log* | grep 'Failed password' | grep sshd | awk '{print $1,$2}' | sort | uniq -c |
Example output :
1 2 | 745 Nov 29 578 Nov 30 |
