<< back

Who Failed

Logs - Who Failed

The challenge seems easy enough:

How many different IP addresses were banned?

However, we don’t want to have to go through and count these manually. Looking at the file, we can see how a ban is formatted:

So we can combine grep and sort as such:

cat fail2ban.log | grep -oe "Ban [0-9.]\{11,19\}" | sort --unique

This gives us unique instances of any strings that look like “Ban X.X.X.X” (11 characters) through “Ban XXX.XXX.XXX.XXX” (19 characters), where X is a number between 0 and 9 or a period.

With a bigger list we would also probably want to leverage the wc command to count the number of lines. So a complete, single line solution for this challenge could be:

cat fail2ban.log | grep -oe "Ban [0-9.]\{11,19\}" | sort --unique | wc -l