Ubuntu

日志文件为/var/log/auth.log

尝试IP和尝试的用户名

cat /var/log/auth.log | grep 'Invalid' | awk '{print $10 "\t" $8}' | sort

用户名次数统计

cat /var/log/auth.log | grep 'Invalid' | awk '{print $8}' | sort | uniq -c | sort -bn

预览

104 ftpuser 112 oracle 147 ubuntu 154 postgres 200 user 318 test 566 admin

CentOS

日志文件为/var/log/secure