I'm trying to get over the /var/log/secure log file, and show only the "Failed Password" log type, which appear at least 3 times.. There is any way to do that using linux commands only? awk? grep?
An example for secure log,
Mar 20 08:38:28 localhost sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=mail.queued.net user=root Mar 20 08:38:31 localhost sshd: Failed password for root from 18.104.22.168 port 2854 ssh2 Mar 20 15:38:31 localhost sshd: Received disconnect from 22.214.171.124: 11: Bye Bye Mar 20 08:38:32 localhost unix_chkpwd: password check failed for user (root) Mar 20 08:38:32 localhost sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=she
from this log file I expect say nothing because there is only 1 Failed Password line, but lets say there were 4 lines of "Failed Password", with the same IP - I want to display the IP address which probably trying to brute force me..