如何过滤secure日志的IP字段

从未被和谐

楼主的数据不全啊...改了一下

grep -P -o "(?<=rhost=)\d+[^\s]+\.\d+" linshi.txt |sort -u

jacson007

下次会注意了

非凡公子

都好复杂.....我来个笨一点的
awk -F= '{print $7}' 1.log | sort | uniq

awk -F= '{print $NF}' 1.log | sort | uniq

[ 本帖最后由 非凡公子 于 2009-7-13 21:27 编辑 ]

非凡公子

LZ又改过啦
只要格式固定,用以下可以实现
cut -d= -f 7- file.log | awk '{print $1}' | sort -u

00306

1. 
   
2. cat file
   
3. 
   
4. Jul 13 08:13:09 localhost sshd[14678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
   
5. Jul 13 08:13:09 localhost sshd[14679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.173.143 user=root
   
6. Jul 13 08:13:11 localhost sshd[14691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172 user=admin
   
7. Jul 13 08:13:11 localhost sshd[14692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.173.143
   
8. Jul 13 08:13:14 localhost sshd[14707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
   
9. Jul 13 08:13:14 localhost sshd[14711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.173.143 user=root
   
10. Jul 13 08:13:17 localhost sshd[14722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
11. Jul 13 08:13:17 localhost sshd[14724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.173.143
    
12. Jul 13 08:13:20 localhost sshd[14739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172 user=root
    
13. Jul 13 08:13:23 localhost sshd[14753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172 user=root
    
14. Jul 13 08:13:26 localhost sshd[14767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
15. Jul 13 08:13:29 localhost sshd[14781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
16. Jul 13 08:13:32 localhost sshd[14795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
17. Jul 13 08:13:35 localhost sshd[14809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
18. Jul 13 08:13:38 localhost sshd[14823]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
19. Jul 13 08:13:41 localhost sshd[14837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172 user=apache
    
20. Jul 13 08:13:44 localhost sshd[14851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
21. Jul 13 08:13:47 localhost sshd[14865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
22. Jul 13 08:13:49 localhost sshd[14876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    
23. Jul 13 08:13:53 localhost sshd[14895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.152.95.172
    

复制代码

1. 
   
2. awk '!a[$14]++{print $14|"sed 's/rhost\=//g'"}' file
   
3. 61.152.95.172
   
4. 222.73.173.143
   
5. 
   

复制代码

[ 本帖最后由 00306 于 2009-7-15 09:16 编辑 ]

greendays

awk -F'=| ' 'NF == 20{print $NF}NF == 22{print $(NF-2)}' urfile

greendays

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' ur

welcome008

我觉得这个应该比较明了些：

awk 'BEGIN{FS="rhost="}{print $2}' filename|cut -d " " -f1|sort -u

david2878

十楼能解释一下/\1/是什么意思吗，为什么要用\1替换呢？

00306

原帖由 david2878 于 2009-7-15 15:47 发表
十楼能解释一下/\1/是什么意思吗，为什么要用\1替换呢？

将括号内的东西存储起来作为标签1，调用的时候用\1就可以，最多可以存储9个这样的标签

1.txt
abc1234

sed 's/\(abc\)1234/\1def/' 1.txt
结果就是
abcdef

[ 本帖最后由 00306 于 2009-7-15 15:59 编辑 ]