[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [cobalt-users] The Code-Red Worm is attacking... GOD it's attacking.



At 11:46 PM 7/19/01, you wrote:
:
> > > >
> > > > cat /var/log/httpd/access | grep .ida | wc -l
> > >
>
> Hi Shimi,
>
> Does your command there actually ask for just the past hour?...or is this
> over the length of the access log?  (still studying this Linux stuff but
> not there yet..:)
>
> I ran this command and got back 259....a few minutes later it was
290.....a
> bit later on....it was 354...8:47PM Eastern time currently, I'm at 384.
> Seems I'm on the block..:)
>
That command will cat the output of /var/log/httpd/access and pipe its
output to the grep command, which will "grep" from the term .ida and the
pipe the output of grep to the wc -l command (word count, # of lines)

Basically is searches for all occurances of the term ".ida" in the httpd log
and then displays that number

Basic unix 101

-Danny
 dcd@xxxxxxxxxxxxxxxxxx

Thanks Danny,..:)

I get the basic part, what I was wondering is where in the command string does it define one hour...and that question probably even moot now since after re-reading Shimi's first note, I see that he says how many time he got hit in the "past" hour, but then he says that command will show a total up to that time...so in effect, it reads the entire access log. Mine spans more than an hour for sure...:)

thanks anyway...I shoulda done more on my end...."re-reading"....seems to be a necessity for me lately....*grin...been missing a lot.

see ya,
Diana

PS....I'm not getting any hits from code red machines any longer....seems to have stopped around here.
Crest Communications, Inc.		diana@xxxxxxxxxxxxx
Beautiful Sunny Florida		http://crestcommunications.com/
352-495-9359, 425-732-9785 fax