Question

A SOC analyst is triaging a Linux authentication log at /var/log/auth.log during an incident. They need to quickly produce a count of how many distinct source IP addresses generated 'Failed password' entries. Which single Bash command pipeline accomplishes this most directly?

Accepted Answer

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq | wc -l

Answer

cat /var/log/auth.log | grep "Failed password" | wc -l

Answer

find /var/log/auth.log -name "Failed password" | sort -u

Answer

grep -c "Failed password" /var/log/auth.log | uniq