From: Fabian W. <fa...@we...> - 2012-05-08 11:18:33
|
Helo Damjan On 07.05.2012 20:59, Damjan wrote: > So I can see if there is regularry attacs from the same IP and I can block > it permanently. You could create a cron job which runs the following command (on one line): awk '/Ban/ { print $7 }' /var/log/fail2ban.log | sort -n | uniq -c | sort -rn | head This should produce a list with the top 10 IP addresses which have been banned in the current log file (I changed the last part of the IP address manually to .x.y for anonymity): 5 122.224.x.y 4 60.190.x.y 4 183.60.x.y 4 124.232.x.y 4 121.14.x.y 4 103.22.x.y 3 72.20.x.y 3 189.42.x.y 3 119.147.x.y 3 113.107.x.y bye Fabian |