每个IP每小时每小时的Python日志文件数

Question

该脚本显示每天每小时发生多少次攻击。 我希望它也按IP地址计数，以便它显示每天每小时每小时遭到攻击的IP地址。

from itertools import groupby

#open the auth.log for reading
myAuthlog=open('auth.log', 'r') 

# Goes through the log file line by line and produces a list then looks for 'Failed password for'
myAuthlog = (line for line in myAuthlog if "Failed password for" in line) 

# Groups all the times and dates together  
for key, group in groupby(myAuthlog, key = lambda x: x[:9]): 
    month, day, hour = key[0:3], key[4:6], key[7:9]

    # prints the results out in a format to understand e.g date, time then amount of attacks
    print "On%s-%s at %s:00 There was %d attacks"%(day, month, hour, len(list(group))) 

日志文件如下所示

Feb  3 13:34:05 j4-be02 sshd[676]: Failed password for root from 85.17.188.70 port 48495 ssh2
Feb  3 21:45:18 j4-be02 sshd[746]: Failed password for invalid user test from 62.45.87.113 port 50636 ssh2
Feb  4 08:39:46 j4-be02 sshd[1078]: Failed password for root from 1.234.51.243 port 60740 ssh2

我的代码示例输出为：

On 3-Feb at 21:00 There was 1 attacks
On 4-Feb at 08:00 There was 15 attacks
On 4-Feb at 10:00 There was 60 attacks

Answer 1

from itertools import groupby
import re
myAuthlog=open('dict.txt', 'r')
myAuthlog = (line for line in myAuthlog if "Failed password for" in line)
for key, group in groupby(myAuthlog, key = lambda x: x[:9] + re.search('from(.+?) port', x).group(1)):
    month, day, hour, ip = key[0:3], key[4:6], key[7:9] , key[10:]
    print "On%s-%s at %s:00 There was %d attacks FROM IP %s"%(day, month, hour, len(list(group)), ip)

日志文件：

Feb  3 13:34:05 j4-be02 sshd[676]: Failed password for root from 85.17.188.70 port 48495 ssh2
Feb  3 21:45:18 j4-be02 sshd[746]: Failed password for invalid user test from 62.45.87.113 port 50636 ssh2
Feb  4 08:39:46 j4-be02 sshd[1078]: Failed password for root from 1.234.51.243 port 60740 ssh2
Feb  4 08:53:46 j4-be02 sshd[1078]: Failed password for root from 1.234.51.243 port 60740 ssh2

输出：

On 3-Feb at 13:00 There was 1 attacks FROM IP 85.17.188.70
On 3-Feb at 21:00 There was 1 attacks FROM IP 62.45.87.113
On 4-Feb at 08:00 There was 2 attacks FROM IP 1.234.51.243

Answer 2

由于您已经知道如何获取每天每小时的日志行，因此请使用以下内容来计算每天每小时的IP。 这不是一个完整的解决方案。

from collections import defaultdict
import re

ip_count = defaultdict(int)
with open('logfile') as data:
  for line in data:
    ip_count[re.findall(r'.*from (.*) port.*', line)[0]] += 1

for ip, count in ip_count.iteritems():
  print ip, count