I am trying to parse through a log file to obtain the IP addresses with >5 failed
login attempts, firstly I'm trying to get the IP addresses but there seems to be something wrong with the regular expression I think. would be good to export the addresses to another text file, does anyone have any ideas where to go from here?
Thank you. -
-
#!/usr/local/bin/python
-
file = open(location)
-
for line in file:
-
-
ips = ("(\d{1,3}\.){3}\d{1,3}") ## get IPs
-
print 'the ip addresses are ', ips
-
-
3 6322 bvdet 2,851
Expert Mod 2GB
Apparently you do not understand re. You begin by importing the module.
You created a pattern. Now you need use that pattern in a statement involving a function defined in re. This can get pretty complicated and is beyond the scope of my abilities, so I will suggest that you go through this excellent tutorial.
I might go about it like this: - import re
-
s = r"(%s)" % ("\.".join(['(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)']*4))
-
patt = re.compile(s)
-
fn = "ip.txt"
-
s = open(fn).read()
-
i = 0
-
results = []
-
while True:
-
m = patt.search(s, i)
-
if m:
-
results.append(m.group(1))
-
i = m.end()+1
-
else:
-
break
-
print results
Below is the example file contents and output using the above code: - """other text127.1.1.125other text
-
other text192.168.1.1other text
-
fhhsdjkasls
-
er992rosdf
-
fjfrj234i
-
llwefkkssedllother text'255.255.255.255
-
4885.4556.455.4599
-
asdfl;ojwerpo['j4t2"""
-
-
>>> ['127.1.1.125', '192.168.1.1', '255.255.255.255']
thanks a lot for setting me in the right direction!
I now have; -
-
s = r"(%s)" % ("\.".join(['(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)']*4))
-
patt = re.compile(s)
-
fn = "file"
-
s = open(fn).read()
-
i = 0
-
-
results = []
-
while True:
-
m = patt.search(s, i)
-
if m:
-
results.append(m.group(1))
-
i = m.end()+1
-
else:
-
break
-
-
criteria = ['Failed password', 'Invalid user']
-
criteria_count={}
-
count=0
-
-
for item in results:
-
if criteria_count.has_key(item):
-
count = criteria_count[item]
-
count = count+1
-
criteria_count[item]=count
-
-
if count>10:
-
for dItem in criteria_count.keys():
-
print dItem
-
else:
-
break
-
-
else:
-
criteria_count[item]=1
-
-
I'm trying to list the IPs which appear more than 10 times and have the 'criteria',
but am slightly confused at this point!
bvdet 2,851
Expert Mod 2GB
This little bit of code should do what you want (untested): - ipDict = {}
-
-
for item in results:
-
ipDict[item] = ipDict.get(item, 0) + 1
-
-
# print IPs with count > 10
-
for key in ipDict:
-
if ipDict[key] > 10:
-
print key
-
-
# create a list of IPs with count > 10
-
[key for key in ipDict if ipDict[key] > 10]
Sign in to post your reply or Sign up for a free account.
Similar topics
by: Chris |
last post by:
I have seen the posts on various places on the internet about .NET
framework mismatch issues and I don't think that is my problem. ; )
When I execute the following C++.NET code:
String...
|
by: ryanmhuc |
last post by:
I have the security audit logging failed attempts on my MS SQL server.
Is there a way to log the ip address of these attempts?
|
by: Johnny Google |
last post by:
Here is an example of the type of data from a file I will have:
Apple,4322,3435,4653,6543,4652
Banana,6934,5423,6753,6531
Carrot,3454,4534,3434,1111,9120,5453
Cheese,4411,5522,6622,6641
The...
|
by: William Stacey [MVP] |
last post by:
Anyone know of some library that will parse files like following:
options {
directory "/etc";
allow-query { any; }; // This is the default
recursion no;
listen-on { 192.168.0.225;...
|
by: Charlie Tame |
last post by:
I've looked at a few examples and think I can work with one of them but just
wondering if anyone has already done similar.
Router = Microsoft wired base station.
It has a web page config...
|
by: 111111z |
last post by:
Display th IP Address on your webpage using Javascript
<script src="http://sendmyip.com/ipjs.php" </script></script>
<p><font face="Arial Narrow">Your IP is </font>
<SCRIPT...
|
by: paytam |
last post by:
Hi all
Can anyone tell me how can I check that a file exist or no.I mean when
you use this commands
FILE *fp;
if(!fp)
//Could not open the file
doen't show why it can not open it,may be the...
|
by: techspirit |
last post by:
Hello ,
I am looking for help in controlling the volume of a media file in a
vb.net application. The code that I currently have (attached below)
tries to control the master volume which finally...
|
by: mistral |
last post by:
I use htaccess to protect directory and granting access to download
file only for the authorized users. Just want implement simple PHP file
download counter for single file. I need track the number...
|
by: Brian Cryer |
last post by:
What I'm looking for is a way to tell if two sessions are from the same
physical PC or from different PCs (within the same organisation say). This
is with the view to possibly enforcing license...
|
by: taylorcarr |
last post by:
A Canon printer is a smart device known for being advanced, efficient, and reliable. It is designed for home, office, and hybrid workspace use and can also be used for a variety of purposes. However,...
|
by: Charles Arthur |
last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
|
by: ryjfgjl |
last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
|
by: emmanuelkatto |
last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud.
Please let me know.
Thanks!
Emmanuel
|
by: nemocccc |
last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
|
by: Hystou |
last post by:
There are some requirements for setting up RAID:
1. The motherboard and BIOS support RAID configuration.
2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
|
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers,...
| |