php - Get IP address in a string -
i'm looking sort of php-code scan /var/log/secure filter breakin attempts. below examples of strings need searched , ip address only. i'm using 0.0.0.0 example of ip address , not actual ip.
failed password invalid user admin 0.0.0.0 port 3108 invalid user ubnt 0.0.0.0 pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=0.0.0.0
with additional information provided op in this comment, decided redo answer. so;
$file=file_get_contents("/var/log/secure"); $lines=explode("\n",$file); $accepted=array(); $fail=array(); $r="/(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/"; foreach($lines $line){ //try ip $t=array(); preg_match($r,$line,$t); $ip=$t[0]; if(strpos($line,"accepted password")!==false){ //successfull login $accepted[]=$ip; } else{ //failed login attempt $fail[]=$ip; } } now $accepted contains ip's logged in successfully, , $fail did not.
i hope helps you.
Comments
Post a Comment