Python - retrieving info from a syslog file

Question

I have been asked to write a program using python for an assignment.

I have been given a syslog file and I have to find things out about it

How do I find out how many attempts were made to login to the root account?

Any advice would be highly appreciated as I am very new to python and completely lost!

Answer 1

something like this

#open the file , can be /var/log/messages, /var/log/maillog etc as defined in your system
f=open("mysyslogfile")
count=0 
#go through the file
for line in f:
   if "<unique pattern for checking root account login>" in line:
       count+=1
#close the file
f.close()
print "total count: " ,count

Answer 2

You want /var/log/auth.log, not syslog.

It'll contain lines like like this:

Mar 20 10:47:24 Opus su[15918]: pam_unix(su:auth): authentication failure; logname=lfaraone uid=1000 euid=0 tty=/dev/pts/25 ruser=lfaraone rhost=  user=root

Basic, naive code to accomplish the problem would be as follows:

loginattempts = {"root": 0,
                 "someuser": 0,} # Usernames you want to check
with open('/var/log/auth.log', 'r') as authlog:
    for line in authlog:
        if "authentication failure" in line:
            username = line.split('=')[-1] # split the string into an array, 
                                           # using '=' as the delimiter
            if username in loginattempts: # is the username one we care about?
                loginattempts[username] += 1

Like user calmh suggested, it will probably be better long-term to parse with regular expressions, but if you don't know them already, it can be non-trivial to learn.

Answer 3

You probably need to read the file, parsing each line. When you find a line that matches what you're interested in (failed root login, for example), you increment a counter.

Take a look at how to read files and possibly how to use regular expressions.

If you are going to do this check against a "live" log file, say every five minutes, you need to keep track of how much of the file you have already processed so you don't read it all every time. This is slightly more complicated, because you need to remember state (file size) between executions. In that case, look at the shelve module.