This repository contains protocols of hostile attacks.
Once a day in the morning the data of the previous day gets collected
using
journalctl:
journalctl --identifier sshd --since=yesterday --until=today --priority=info --output=json
Next the IP addresses are extracted using jq or jaq:
jaq -r -c '
._SOURCE_REALTIME_TIMESTAMP as $ts
| .MESSAGE
| capture("from (?<ip>[0-9.]+) to") // capture("from \\[(?<ip>[^\\]]+)\\].* failed authentication")
| {ts: $ts, ip: .ip}'
Finally the IP address is looked up using OpenRDAP.
location-lookup ip