back to labs
Log Analysis: Top Offending IPs
MediumShell Scripting10-20 minThe brief
A real sysadmin task: find who's hammering your SSH. /root/logs/auth.log has 'Failed password ... from <IP>' lines among the noise.
Write a script (and run it) that produces /root/out/top.txt: the top 5 source IPs by number of failed-password attempts, most first. Each line must carry the leading count then the IP (<count> <IP>, one pair per line — exactly the way uniq -c prints a counted tally; its leading spaces are optional).
Grading recomputes the ranking and compares, so the counts and the order must both be right.
What you'll do
- Extract failed-login source IPs from auth.log
- Rank the top 5 by count into /root/out/top.txt
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.