0

I'm working on a bash script to search a set of log files that record login attempts to the server and isolate if the most recent attempt resulted in an account lockout.

First, I crafted a a variable to search all the log files created in the last two hours for the start of a login attempt as well as the username which I specified in a variable earlier in the script.

> conn1="$(find /vendor/ldap/logs/ -mmin -120 -exec egrep "(BIND.*$username)" {} \; 2> /dev/null | tail -1)"

This one works fine. When I echo it, it does display only the last (most recent) entry in the log files that has both the words 'BIND' and the $username in it.

In this case when I search for a connection from username zn0273 it produces this:

[21/Feb/2019:07:26:27 -0600] conn=1518823653 op=0 msgId=10776 - BIND dn="uid=zn0273, ou=people, ou=US, ou=Americas, o=company.com" method=128 version=3

The line returned by the variable always has a 10 digit connection number at the 35th character position, so I then extracted it with a substring.

conn2="${conn1:34:10}"

This also works. When I echo it, it gives me the exact 10 digit number I need from that line, no more, no less.

1518823653

Where everything falls apart is the next line. I need a variable to tell me if there is another line in the log that has that 10 digit connection number in it and the phrase 'err=19' which, on this server, indicates that this connection locked out the account. To that end I crafted a variable similar to $conn1

conn3="$(find /vendor/ldap/logs/ -mmin 120 -exec egrep "($conn2.*err=19)" {} \; 2> /dev/null)"

When I echo this one it gives me nothing, and that's after I verified that such a line does exist in one of the files being scanned. it looks like this:

[21/Feb/2019:07:26:27 -0600] conn=1518823653 op=0 msgId=10776 - RESULT err=19 tag=97 nentries=0 etime=0, Exceed password retry limit. Account locked.

The only difference I can think of is that in the egrep pattern the variable comes first instead of second and maybe I'm missing something in the syntax.

What am I missing?

  • 2
    Please also add to your question a log file snippet that could be used to test your commands. It should have the line that is used to set conn1 and at least one line that you want to be used to set conn3. – Bodo Feb 20 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.