Reporting On Rejected Logins...

[lh21979r]

Here is a script I wrote which counts the number of rejected login attempts which occur on a daily basis and emails the details to a selected recipient. We have this running on HP-UX 11.11, but I think it should work for any Unix version, although might require a bit of tinkering. The idea behind it is that we wanted to see how many rejected logins occured each day so that we had a clearer idea of how many extra licenses we needed to buy...

£!/bin/sh
£
£ Rejected ServiceCenter Logins
£
£ Setup Variables
 
REPORT=/peregrine/logs/screject.log
RECIPIENT=email.address@yourcompany.com
OLDREP=/peregrine/logs/screject.old
 
£ Setup Report Files
 
rm $OLDREP
touch $REPORT
 
£ Filter today's SC.log file and pull out messages about rejected logins.
 
awk -v "date=`date`" '
BEGIN { print date;
print "-------------------------------------------------------------------------
------" ; c=0 }
 
{ if (match($0, "rejected") != 0) {print "Login for "$7" rejected at "$2" "subst
r ($3, 1, 5) ;c++}}
END {
print;print "Total rejected logins: "c}' /peregrine/logs/sc.log > $REPORT 2>&1
 
sleep 5
 
£ Mail the output of the script to $RECIPIENT
 
cat $REPORT | ux2dos | uuencode rejected_logins.txt | mailx -s "ServiceCenter Re
jected Logins" $RECIPIENT
 
sleep 5

mv $REPORT $OLDREP
 
exit 0

[Maggie]

thx, was not looking for this particular subject, but something simular! ;-)
I have a awk script keeping statistics on logons per month, average and max etc.... Trade? If not, ok, will use your script anyway, or will you, as an american, sue my a** off then when I don't have written permission (and promise not to put it in microwave together with pet :lol: ?

thx again, I'm not too good at scripts like this, so anything is welcome to 'steal' from!

[lh21979r]

Of course, everyone is free to use this script. Besides, I'm not american, hence the Union Jack under my name

I'd be interested in the script you have Maggie, that sounds interesting.

[Maggie]

Ok, here things are. Have to admit, I had never looked at it much, but now I did because of posting here... and although I am glad with the monthly mail it generates, I have some mixed feelings about how it is done. But that is maybe also because I have read a lot of other's solutions coming up with the same result, in the meantime. By the time this was made, we did not know another way....And at the same time I don't really know awk, so maybe that's why I hesitate...

Some of the code is very company-specific, but I think you will get it. Most comment is in English, some of it is dutch... sorry.
Three files:
- reportlic.awk doing the actual stuff
- maillic sending the monthly result to admins and others
- October (monthly file) just to get a glance of what is generated

(Oh, and renamed them all to '.txt' because while attaching I got some errors/warmings about wrong extensions being used... or not allowed.)

Well, who knows, you might use some of it! If you have questions, please ask, but I did not make this, nor know awk too well, so I will probably have to post your question to the creator....

(and sorry for getting the country wrong, thought of it later, but message was already sent....feel dumb! ;-)

Bye!