日志内容: …… authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=61.146.178.13 authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=bin86.ee.ccu.edu.tw authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=137.65.134.61.net.jq.gs.dynamic.163data.com.cn ……

#!/usr/bin/perl
use strict; 

# Open log file
open(XXX, "/path/to/logfile") || die "Error Reading File : $!";
my @urls = <xxx>;
close(XXX); 

my $i = 0;
my @ips = (); 

for my $ip (@urls) {
    #if ($ip =~ /rhost=((d{1,3}.d{1,3}.d{1,3}.d{1,3})?.*) /isg) {
    if ($ip =~ /rhost=(.*) /isg) {
        $i ++;
        unless (is_in_array($1, @ips)) {
            push @ips, $1;
        }
    }
} 

print "All attack count : $in";
print "Use $#ips IP(s)n";
print "The ips are : @ipsn"; 

sub is_in_array
{
    my $ip = shift();
    my $s = shift();
    my @ips = @$s;
    my $in = 0; 

    for (@ips) {
        if ($_ eq $ip) {
            $in = 1;
            last;
        }
    }
    return $in; 

}