Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall statement and count number how many particular IP occurred on the list.

So far I know how to display all logs for particular firewall statement, but no clue how to retrieve source IP from the message column and count particular IP occurrence.

Is there any additional software which can do that or I need to create own log parser to get this done?

Thanks

share|improve this question

1 Answer 1

up vote 0 down vote accepted

We use AWK.

Feb 25 12:18:50 host.example.come kernel: LOGPREFIX: IN=eth0 OUT= MAC=00:aa:aa:bb:cc:dd:00:ee:00:aa:dc:00:aa:00 SRC=x.x.x.x DST=y.y.y.y LEN=40 TOS=0x00 PREC=0x00 TTL=95 ID=256 PROTO=TCP SPT=6000 DPT=22 WINDOW=16384 RES=0x00 SYN URGP=0
  1. Awk out the SRC address
  2. Sort the list numerically (prereq to uniq)
  3. Use uniq with the -c flag to get counts per source
  4. Optionally: sort again numerically to see the heaviest violators.

[root@host.example.com faculty]# grep LOGPREFIX /var/log/messages | \
    awk '{print $10}' | sort -n | uniq -c | sort -n

Output:

      5 SRC=x.174.x.x
      6 SRC=61.y.y.y
      6 SRC=z.z.z.196
     17 SRC=a.a.246.a

Finally: an AWK Primer: http://www.grymoire.com/Unix/Awk.html

share|improve this answer
    
Almost there. On centOS I need to use GAWK but after slight modification of your example I'm getting something like src=95.x.y.z:19788:X1 which comes multiple times because of different port. Any clue how to strip output on :? –  JackTheKnife Feb 25 at 18:50
    
so re-gawk with a new field delimiter of : grep ... | awk... | awk -F: '{print $1}' | ... rest –  lVlint67 Feb 25 at 18:52
    
Great, it works. Thanks! –  JackTheKnife Feb 25 at 19:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.