首先知道，系统的用户登陆日志文件是/var/log/secure，所以分析统计这文件就可以

#tail -n50 secure-20161219 （可以看到大量Failed password的记录）

Dec 19 03:41:35 localhost sshd[9014]: Failed password for root from 59.63.166.84 port 26368 ssh2
Dec 19 03:41:36 localhost sshd[9014]: Failed password for root from 59.63.166.84 port 26368 ssh2
Dec 19 03:41:37 localhost sshd[9014]: Failed password for root from 59.63.166.84 port 26368 ssh2
Dec 19 03:41:37 localhost sshd[9014]: Failed password for root from 59.63.166.84 port 26368 ssh2
Dec 19 03:41:38 localhost sshd[9014]: Failed password for root from 59.63.166.84 port 26368 ssh2
Dec 19 03:41:38 localhost sshd[9014]: error: maximum authentication attempts exceeded for root from 59.63.166.84 port 26368 ssh2 [preauth]
Dec 19 03:41:38 localhost sshd[9014]: Disconnecting: Too many authentication failures [preauth]
Dec 19 03:41:39 localhost sshd[9016]: Failed password for root from 59.63.166.84 port 32555 ssh2

我们要过滤出Failed行并显示对他的ip地址做统计排序，找到攻击最大的几个

#awk '/Failed password/{print $(NF-3)}' secure-20161219|sort|uniq -c|sort -nrk1|head -20

  68652 218.65.30.25
  34326 218.65.30.53
  21201 218.87.109.154
  18065 112.85.42.103
  17164 112.85.42.99
  17163 218.87.109.151
  17163 218.87.109.150
  17163 218.65.30.61
  17163 218.65.30.126
  17163 218.65.30.124
  17163 218.65.30.123
  17163 218.65.30.122
  17163 182.100.67.120
  17163 182.100.67.119
  17163 112.85.42.124
  17163 112.85.42.107
   3289 222.186.50.206
   3265 219.133.29.16
   3206 111.73.46.156
   2479 117.21.226.189

（解释下# awk '/Failed password/{print $(NF-3)}' secure-20161219|sort|uniq -c|sort -nrk1|head -20）

awk根据Failed password匹配出了破解记录，然后取倒数第四列的ip，取到的结果先进行排序（目的是为了下一个uniq函数），uniq -c去重并计算数目（只支持比较连续的行所以前面用sort）,对去重后的数据按照第一列（-k1）进行数字（n）倒序（r），最后只取前20行

第二种方法（awk数组方式）：

#awk '/Failed password/{d[$(NF-3)]++}END{for(i in d) print i,d[i]}' secure-20161219|sort -nrk2|head -20

218.65.30.25 68652
218.65.30.53 34326
218.87.109.154 21201
112.85.42.103 18065
112.85.42.99 17164
218.87.109.151 17163
218.87.109.150 17163
218.65.30.61 17163
218.65.30.126 17163
218.65.30.124 17163
218.65.30.123 17163
218.65.30.122 17163
182.100.67.120 17163
182.100.67.119 17163
112.85.42.124 17163
112.85.42.107 17163
222.186.50.206 3289
219.133.29.16 3265
111.73.46.156 3206
117.21.226.189 2479