def parse_log_file(self):
"""
Parse the log file to extract IP address
showing quick Recieved Disconnect.
Args:
None
Raises:
None
Returns:
None
"""
# Open the log file
log_file_data = utils.open_file(self.log_file)
for line in log_file_data:
found = re.findall(self.RECIEVED_DISCONNECT, line)
if (found is not None and found != []):
date = found[0][0]
month = date.split(" ")[0]
day = date.split(" ")[1]
last_time = found[0][1]
ip = found[0][2]
# convert date, time to epoch time
epoch_time = utils.get_epoch_time(month, day, last_time)
self.update_ip_dict(ip, date, epoch_time)
def parse_log_file(self):
"""
Parse log file to extract invalid SSH user /
their authentication failure / login attempts.
Args:
None
Raises:
None
Returns:
None
"""
# Open the log file
log_file_data = utils.open_file(self.log_file)
for line in log_file_data:
found = re.findall(self.INVALID_USER, line)
if (found is not None and found != []):
date = found[0][0]
month = date.split(" ")[0]
day = date.split(" ")[1]
last_time = found[0][1]
username = found[0][2]
ip = found[0][3]
# convert date, time to epoch time
epoch_time = utils.get_epoch_time(month, day, last_time)
self.update_username_dict(username, ip, date, epoch_time)
def parse_log_file(self):
"""
Parse the log file to extract
authentication failure / login attempts.
Args:
None
Raises:
None
Returns:
None
"""
# Open the log file
log_data = utils.open_file(self.log_file)
for line in log_data:
found = re.findall(self.AUTH_FAILURE, line)
if (found is not None and found != []):
username = re.findall(self.USERNAME, found[0])[0][1]
data_in_list = found[0].split(" ")
if data_in_list[1] != "": # if double digit day
month = data_in_list[0]
day = data_in_list[1]
last_time = data_in_list[2]
date = month + " " + day
else: # if single digit day
month = data_in_list[0]
day = data_in_list[2]
last_time = data_in_list[3]
date = month + " " + day
# convert date, time to epoch time
epoch_time = utils.get_epoch_time(month, day, last_time)
count = 1 # number of attempts (by default is 1)
message_repeated = re.findall(self.MESSAGE_REPEAT, found[0])
if message_repeated != []:
count = int(message_repeated[0])
# update user_to_count dict
self.update_user_dict(username, date, epoch_time, count)