I found a command in a CentOS7 tutorial to get a small table of the number of the user that try connect via ssh:



The code is the next:

zgrep -hi "Failed password for " /var/log/secure* | sed "s/invalid user //" | tr -s " " | awk '{print $11" "$9}' | sort | uniq -c | sort -rn | head -20

zgrep -hi "Failed password for " /var/log/secure* | 
sed "s/invalid user //" | 
tr -s " " | 
awk '{print $11" "$9}' | 
sort | 
uniq -c | 
sort -rn | 
head -20

I want to know how its work?


1 Answer 1


The first command searches your /var/log/secure log for failed login attempts

zgrep -hi "Failed password for " /var/log/secure*

will produce a result like this:

Aug  1 21:22:53 jbclamp001 sshd[40401]: Failed password for jbutryn from ip.ip.ip.ip port 55843 ssh2

the command:

sed "s/invalid user //"

Will search for the phrase "invalid user " and replace it with ""

the command:

tr -s " "

Will trim any extra blank characters from the string.

The command:

awk '{print $11" "$9}'

will then grab only column's 11 and 9 and print them (this is the IP address and username)

the command:


will then sort all your results alphanumerically?

the command:

uniq -c

will remove any duplicate values

the command:

sort -rn

sorts the list in reverse numerical order?

the command:

head -20

will only show the top 20 values from your results.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .