Tracking Failed login attempts

[Dervie]

Hello, I am trying to track failed login attempts in SCO. I have used a script that I got from a forum here and it has worked to a degree. Here is the script I used:

cd /tcb/files/auth
awk -F: '
{for(i=1;i<=NF;++i)if($i~/unsuclog/)print substr(FILENAME,3),$i}
' ?/* | while read user date
do echo "$user\t$(perl -e 'use POSIX;print ctime($date)')"
done

and here is the result:

dpalmer $(perl -e 'use POSIX;print ctime(u_unsuclog#1239206368)')

I would love to get a proper date and time when the unsuccessful login took place. Could someone please tell me what's wrong with the code?

 

[PHV]

Replace this:
print substr(FILENAME,3),$i
with this:
d=$i;sub(/.*#/,"",d);print substr(FILENAME,3),d

and this:
$(perl -e 'use POSIX;print ctime($date)')
with this:
`perl -e 'use POSIX;print ctime($date)'`

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[Dervie]

Thanks PHV. I now have this

cd /tcb/files/auth
awk -F: '
{for(i=1;i<=NF;++i)if($i~/unsuclog/)d=$i;sub(/.*#/,"",d);print substr(FILENAME,3),d}
' ?/* | while read user date
do echo "$user\t`perl -e 'use POSIX;print ctime($date)'`"
done

The result however is still undesirable because now it doesn't tell me about unsuccessful/successful. Here is a sample of the output.

dpalmer Wed Dec 31 19:00:00 1969
dpalmer Wed Dec 31 19:00:00 1969
dpalmer Wed Dec 31 19:00:00 1969
dpalmer Wed Dec 31 19:00:00 1969

This is displayed for every user.

 

[PHV]

sorry for the typo:
{for(i=1;i<=NF;++i)if($i~/unsuclog/)[!]{[/!]d=$i;sub(/.*#/,"",d);print substr(FILENAME,3),d[!]}[/!]}

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[Dervie]

PHV, This is what I have now

cd /tcb/files/auth
awk -F: '
{for(i=1;i<=NF;++i)if($i~/unsuclog/){d=$i;sub(/.*#/,"",d);print substr(FILENAME,
3),d}}
' ?/* | while read user date
do echo "$user\t`perl -e 'use POSIX;print ctime($date)'`"
done


This is the result
dpalmer Wed Dec 31 19:00:00 1969
dpalmer Wed Dec 31 19:00:00 1969

Still doesn't tell me about u_unsuclog as shown above and the dates are still the same.

 

[PHV]

what about this ?

cd /tcb/files/auth
awk -F: '{for(i=1;i<=NF;++i)if($i~/_unsuclog/){
  split($i,x,/#/);print substr(FILENAME,3),x[1],x[2]
}}' ?/* | while read user unsuc date
do echo "$user\t$unsuc\t`perl -e 'use POSIX;print ctime('$date')'`"
done

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886