34 lines
719 B
Python
34 lines
719 B
Python
#!/usr/bin/env python3
|
|
import sqlite3
|
|
from datetime import datetime
|
|
|
|
db = sqlite3.connect("sshd_failures.db")
|
|
|
|
for row in db.execute("""
|
|
SELECT
|
|
g.country,
|
|
COUNT(*) AS total,
|
|
MAX(f.ts) AS last_seen,
|
|
(
|
|
SELECT f2.ip
|
|
FROM failures f2
|
|
JOIN ip_geo g2 ON f2.ip = g2.ip
|
|
WHERE g2.country = g.country
|
|
GROUP BY f2.ip
|
|
ORDER BY COUNT(*) DESC
|
|
LIMIT 1
|
|
) AS top_ip
|
|
FROM failures f
|
|
JOIN ip_geo g ON f.ip = g.ip
|
|
GROUP BY g.country
|
|
ORDER BY total DESC
|
|
"""):
|
|
country, total, last_seen, top_ip = row
|
|
|
|
if last_seen:
|
|
last_seen = datetime.fromtimestamp(last_seen)
|
|
|
|
print(f"{country:25} {total:6} top_ip={top_ip:18} last={last_seen}")
|
|
|
|
db.close()
|