Ubuntu

查找 /log/ 目錄中的所有 IP 地址,並將這些行輸出到文件中,不重複

  • March 9, 2019

我正在嘗試從呼叫的目錄中的文件中檢索所有具有 IP 地址的行log並將它們寫入文件,但我運氣不佳。目前我正在輸入:

find . -path "*/log/*" -type f | xargs grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" | xargs grep -v "[myip]" > log.txt | sort -u

但這只是輸出以下內容:

Binary file ./var/log/wtmp.1 matches
Binary file ./var/log/lastlog matches
Binary file ./var/log/btmp matches
Binary file ./var/log/btmp.1 matches
Binary file ./var/log/wtmp matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-00000000000334f4-000547883cd64bfc.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-000000000003109b-000547834461e9ac.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-000000000002ec72-0005477e385a43c7.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-000000000002c42c-0005477bb1a39b46.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-0000000000029d35-00054776e06fb915.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-0000000000027310-000547743bc488ca.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-0000000000024a25-00054771307a13d2.journal matches
Binary file ./run/log/journal/9dec9e4e32834bb59a2d5e1c50895ca5/system@4d01f718aa76471eafb1b2faa76e05e2-0000000000022116-0005476e66afb18c.journal matches

這根本不是我所追求的。我需要正確編寫此查詢嗎?理想情況下,輸出應如下所示:

Started GET "/" for [IP] at 2017-02-02 19:15:39 +0000
Cannot render console from 85.248.227.164! Allowed networks: 127.0.0.1, ::1, 127.0.0.0/127.255.255.255
[...]
Jan 29 06:25:04 ubuntu sshd[24085]: Failed password for root from [IP] port 41348 ssh2

依此類推,不包括我的 IP 地址和任何相關結果。理想情況下,每個匹配項都附加文件路徑和行號。

find . -path "*/log/*" -type f | exec grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" {} > log.txt

不向日誌文件輸出任何內容。部分問題似乎與額外的過程有關,因為

find . -path "*/log/*" -type f | xargs grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)" > log.txt

是否輸出 IP 地址,它只是用我的 IP 得到很多重複的東西和大量的結果,這是我不想要的。

我使它工作使用:

regex="(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"
sudo find / -path "*/log/*" -type f -exec grep -Eo $regex {} +

如果您希望對其進行排序,請通過管道將其通過sort,並添加重定向以將其保存在文件中。

sudo find / -path "*/log/*" -type f -exec grep -Eo $regex {} + \
 | grep -v "[myip]" | sort | uniq > log.txt

引用自:https://unix.stackexchange.com/questions/342099