回答-BFW问答

linux错误登录密码次数及ip地址命令：

grep -i "failed password" /var/log/secure | awk '{if($11 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) print $11; else print $13}' | sort -nr -k1 | uniq -c

linux成功登录密码次数及ip地址命令：

grep -i "accepted password" /var/log/secure | awk '{if($11 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) print $11; else print $13}' | sort -nr -k1 | uniq -c

回答