DEV Community

Shubham Chaudhary
Shubham Chaudhary

Posted on

Your Terminal Already Ships With a Log Analyzer: Rank Attacker IPs With Linux sort

#cybersecurity #linux #bash #tutorial

Logs are mostly repetition. The same IP shows up hundreds of times, and sort is the fastest way to make that visible.

The core pattern:

sort | uniq -c | sort -nr
Enter fullscreen mode Exit fullscreen mode

Applied to failed SSH logins:

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -10
Enter fullscreen mode Exit fullscreen mode

Output looks like 412 203.0.113.45: the failure count, then the source IP. Check the field position on a sample line, since log formats vary. On RHEL-family systems, use /var/log/secure.

Three gotchas worth knowing:

  • uniq only collapses adjacent duplicates, so the first sort is required.
  • sort -k2 runs to the end of the line. Use -k2,2 to sort on one field.
  • sort file > file empties the file. Use sort -o file file instead.

A high count shows what stands out, not what is malicious. Correlate it with successful logins, then harden SSH with keys, no root login, and MFA.

I wrote a fuller guide with 20+ examples covering -n, -h, -V, CSV sorting, and matching logs against a threat-intel list with comm:

https://www.xpert4cyber.com/2026/09/linux-sort-command-guide.html

What's the first command you run on a suspicious log?

Top comments (0)