Shell Programming and Scripting

Hello,

I have done some BASIC shell scripting/PERL scripting before so I am familiar with the languages. I am not really sure which one would lend itself better to the application I have to write.

I am required to scan the message logs for possible break in attempts. If I use shell scripting I could use GREP for a particular pattern and I am sure PERL has some similar pattern scanning capability. I am not sure which language could accomplish the following more easily: In each warning attempt I would have to locate the username used to loggin and keep track of how often this username attempted a loggon in a variable.

Opinions/suggestions?

I would think a grep to an awk script. The awk script would accumulate the needed information in one or more arrays. When done reading the log file, you would then process/print any data accumulated in the awk arrays.

I am a little new to UNIX programming so I would like to run by you what I plan to do. I would grep for the patterns I need, store it to the a temp file and then, run awk on the temp file to process its contents.....that seems the most straightforward method to me.

One question: If the grep results in no result, how can I tell the script to simply exit? In C++ we could do something like if ![grep pattern] then...how would we go about doing this in shell scripting?

I would look into using an out of the box, open source tool to get what you need done. The online docs leave a lot to be desired, but OSSEC is a really powerful tool for log parsing (Welcome to the Home of OSSEC), and it's free.

No need to reinvent the wheel.

And for what you're doing, it's not enough just to grep through a log. You need to keep track of what you already processed so you're not spamming the same alert every time your script runs.

Security ecompasses so much more than poking through a log.

Good luck.