Ubuntu
日志文件为/var/log/auth.log
尝试IP和尝试的用户名
cat /var/log/auth.log | grep 'Invalid' | awk '{print $10 "\t" $8}' | sort
用户名次数统计
cat /var/log/auth.log | grep 'Invalid' | awk '{print $8}' | sort | uniq -c | sort -bn
预览
104 ftpuser
112 oracle
147 ubuntu
154 postgres
200 user
318 test
566 admin
CentOS
日志文件为/var/log/secure