I found a command in a CentOS7 tutorial to get a small table of the number of the user that try connect via ssh:



The code is the next:

zgrep -hi "Failed password for " /var/log/secure* | sed "s/invalid user //" | tr -s " " | awk '{print $11" "$9}' | sort | uniq -c | sort -rn | head -20

zgrep -hi "Failed password for " /var/log/secure* | 
sed "s/invalid user //" | 
tr -s " " | 
awk '{print $11" "$9}' | 
sort | 
uniq -c | 
sort -rn | 
head -20

I want to know how its work?


1 Answer 1


The first command searches your /var/log/secure log for failed login attempts

zgrep -hi "Failed password for " /var/log/secure*

will produce a result like this:

Aug  1 21:22:53 jbclamp001 sshd[40401]: Failed password for jbutryn from ip.ip.ip.ip port 55843 ssh2

the command:

sed "s/invalid user //"

Will search for the phrase "invalid user " and replace it with ""

the command:

tr -s " "

Will trim any extra blank characters from the string.

The command:

awk '{print $11" "$9}'

will then grab only column's 11 and 9 and print them (this is the IP address and username)

the command:


will then sort all your results alphanumerically?

the command:

uniq -c

will remove any duplicate values

the command:

sort -rn

sorts the list in reverse numerical order?

the command:

head -20

will only show the top 20 values from your results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.