vigneshwari-08/server_log-analyzer-intrusion-detector

★ 19ShellAudience · ops devopsComplexity · 2/5ActiveSetup · easy

Mindmap

mindmap
  root((log-analyzer))
    Inputs
      Hour window
      Linux logs
      journalctl output
    Outputs
      Ranked error counts
      Attacker IP list
      Tried usernames
    Use Cases
      Spot SSH brute force
      Audit recent errors
      Schedule a daily check
    Tech Stack
      Bash
      journalctl
      grep
      awk

mindmap root((log-analyzer)) Inputs Hour window Linux logs journalctl output Outputs Ranked error counts Attacker IP list Tried usernames Use Cases Spot SSH brute force Audit recent errors Schedule a daily check Tech Stack Bash journalctl grep awk

Things people build with this

USE CASE 1

Run a quick audit of the last 24 hours of errors on a Linux server

USE CASE 2

Find SSH brute-force attempts and rank attacker IPs

USE CASE 3

Schedule the script as a daily cron job and read the morning summary

USE CASE 4

Adapt the script as a learning template for journalctl, grep, and awk

Tech stack

Bashjournalctlgrepawkcron

Getting it running

Difficulty · easy Time to first run · 5min

Needs a Linux host with systemd journalctl; will not work on systems that ship rsyslog only without journald.

In plain English

This repository contains a single Bash script that scans the logs on a Linux server, ranks errors by how often they appear, and looks for signs that someone has been trying to break in over SSH. The author wrote it as part of a personal DevOps learning series posted on LinkedIn. The script pulls system errors from the last N hours, detects SSH brute force attempts, ranks the IP addresses doing the attacks, and lists which usernames the attackers tried. It also walks through log files under /var/log, picks out lines that contain words like error, fatal, or failed, and counts them so you can see which problems happen most often. Output is printed to the terminal with colour. It expects a Linux server with bash, journalctl from systemd, and curl, and the author says it has been tested on Amazon Linux 2023, Ubuntu 22.04, and CentOS 8. Usage is simple: clone the repo, make log-analyzer.sh executable, and run it with no arguments for the default 24-hour window, or pass a number like 1 for the last hour. A large part of the README is a teaching walkthrough that explains the commands behind the script, including journalctl with priority filters, grep with extended regex, awk for picking fields out of log lines, sort, uniq -c, and find with -mmin. The README also shows how to put the script on a cron job to run every morning, includes a sample output block, and ends with the author's note that within hours of launching an EC2 instance the script caught 86 SSH attempts from a single IP.

Copy-paste prompts

Prompt 1

Run log-analyzer.sh on my Ubuntu server for the last hour and explain the output

Prompt 2

Extend the script to also detect failed sudo attempts and rank by user

Prompt 3

Send the script output to a Slack webhook instead of printing to terminal

Prompt 4

Add a JSON output mode so the results can be ingested by a SIEM

Prompt 5

Rewrite the SSH brute-force section to also block offending IPs via fail2ban

Open on GitHub → Explain another repo

Generated 2026-05-22 · Model: sonnet-4-6 · Verify against the repo before relying on details.