TanjiroLogAnalysis/tanjirologanalyser.sh at master · tanjironezuko1900/TanjiroLogAnalysis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
#!/bin/bash


VERSION='1.0'
AUTHOR='tanjironezuko1900'

clear

figlet -f big TANJIRO LOG ANALYSER

LOGCMD='journalctl'
echo
echo "=======LOG ANALYSER======="
echo
echo "1) Failed Login Attempts"
echo "2) Suspicious IP Addresses"
echo "3) Full Report"
echo "4) Exit"
echo
echo 'Enter your choice:'
read choice

if [ "$choice" -eq 1 ]; then
	echo
	echo "Failed Login Attempts"
	echo
	count=$($LOGCMD | grep -Ei "FAILED SU|failed password" | wc -l)
	echo "Total Attempts: $count"
fi

if [ "$choice" -eq 2 ]; then
	echo
	echo "Suspicious IP Addresses:"
	echo

	ips=$($LOGCMD | grep -Ei 'failed password' | awk '{print $11}' | sort | uniq -c)

	if [ -z "$ips" ]; then
		echo "No suspicious IPs found"
	else
		echo "$ips"
	fi
	echo "Local Login Attacks:"

	localcount=$($LOGCMD | grep -Ei "FAILED SU" | wc -l)
	if [ -z '$localcount' ]; then
		echo 'No local login attacks'
	else
		echo "$localcount local login attacks"
	fi
fi


if [ "$choice" -eq 3 ]; then
	echo
	echo "===== FULL REPORT ====="
	echo

	count=$($LOGCMD | grep -Ei 'FAILED SU|failed password' | wc -l)

	echo "Total Failed Attempts: $count"
	echo
	echo
	echo
        echo "Suspicious IP Addresses:"
        echo

        ips=$($LOGCMD | grep -Ei 'failed password' | awk '{print $11}' | sort | uniq -c)

        if [ -z "$ips" ]; then
                echo "No suspicious IPs found"
        else
                echo "$ips"
        fi
	echo "Local Login Attacks:"

        localcount=$($LOGCMD | grep -Ei "FAILED SU" | wc -l)
        if [ -z '$localcount' ]; then
                echo 'No local login attacks'
        else
                echo "$localcount local login attacks"
        fi
fi

if [ "$choice" -eq 4 ]; then
	exit
fi