[Logwatch] IP Summary

Bob Hutchinson hutchlists at midwales.com
Tue Sep 6 16:10:50 MST 2005


On Tuesday 06 Sep 2005 18:32, John wrote:
> Is it possible to have logwatch generate a summary by IP instead of by
> username. It would look something like this
>  Failed logins from these:
> aaa.aaa.aaa.aaa 10 times
> bbb.bbb.bbb.bbb 79 times
>   Instead of this
>
> Failed logins from these:
> 123/password from aaa.aaa.aaa.aaa: 1 Time(s)
> 123456/password from aaa.aaa.aaa.aaa: 1 Time(s)
> JCPU/password from bbb.bbb.bbb.bbb: 1 Time(s)
> NSCD/password from bbb.bbb.bbb.bbb: 1 Time(s)
> PCPU/password from bbb.bbb.bbb.bbb: 1 Time(s)
> TTY/password from bbb.bbb.bbb.bbb: 1 Time(s)
> X11/password from bbb.bbb.bbb.bbb: 1 Time(s)

edit scripts/services/sshd to suit your needs. Look for $BadLogins

-- 
-----------------
Bob Hutchinson
Midwales dot com
-----------------


More information about the Logwatch mailing list