LINUX btmp Logs (LASTB command)

Linux under/var/log/btmp file:

Today, check the server, found that the/var/log/btmp log file is relatively large, search, this file is log error logging, that is, there are many people trying to log into the SSH service using a password dictionary, this log needs to be opened using the LASTB program.

1, Firewall shield malicious login IP:(through this file can find malicious IP always try to log in)

Iptables-a input-i eth0-s *.*.*. 0/ -j DROP

2. View the number of rogue IP attempts to log in:

Lastb awk ' {print $} ' Sort Uniq Sort -n or lastbawk'/\ (/{print $}'sort  uniqsort -N

3. Delete this log:

rm -rf/var/log/btmpTouch /var/log/btmp

LINUX btmp Logs (LASTB command)