-1

I ran this command

cat /var/log/syslog | grep SRC= | awk '{print $1,$2, $3, $12}'

I saw thousands of IPs

Apr 24 23:15:47 SRC=79.124.62.86
Apr 24 23:15:59 SRC=192.241.221.145
Apr 24 23:16:18 SRC=193.27.228.62
Apr 24 23:16:38 SRC=5.51.177.42
Apr 24 23:16:59 SRC=79.124.62.86
Apr 24 23:17:21 SRC=79.124.62.86
Apr 24 23:17:40 SRC=1.14.43.72
Apr 24 23:18:06 SRC=104.206.128.50
Apr 24 23:18:34 SRC=78.128.113.162
Apr 24 23:18:41 SRC=121.196.155.112
Apr 24 23:19:10 SRC=79.124.62.86
Apr 24 23:19:30 SRC=79.124.62.86
Apr 24 23:19:40 SRC=78.128.113.222
Apr 24 23:20:00 SRC=45.135.232.24
Apr 24 23:20:21 SRC=79.124.62.86
Apr 24 23:20:46 SRC=79.124.62.86

I wasn't able to find any relation of these IP in my /var/log/auth.log

Are these hackers/bots attempt to get in my box ?

Improve this question
3
  • 1
    Useless Use of cat, and look at surrounding lines: grep -A2 -B2 'SRC=' /var/log/syslog. Use journalctl, a better way of handling logs. Read journalctl hints in my AskUbuntu profile.
    – waltinator
    Apr 25, 2021 at 6:17
  • I ran your grep and not see same result as my cat command.
    – code-8
    Apr 25, 2021 at 15:23
  • @waltinator was just asking for some better context, same as I have. The grep command works fine, providing the previous and following 2 lines.
    – Doug Smythies
    Apr 25, 2021 at 15:36

1 Answer 1

Reset to default
2

For some reason you have hidden virtually all of the useful information from your question. However, yes it would mostly be hackers/bots searching for vulnerabilities. Some entries will be legitimate, and likely related to TCP sessions where your machine thinks the connection has been closed and forgotten, but the remote machine thinks it isn't.

Those log entries are probably from iptables log rules. If you are using UFW, know that it is just a front end for iptables. Notice that 7 out of 16 of your example list are from 79.124.62.86. Please know that particular sub-net is one of a great many that are very bad. This from my iptables rule set, where I DROP the entire sub-net:

doug@s15:~$ sudo iptables -xvnL
Chain INPUT (policy DROP 14 packets, 1478 bytes)
pkts   bytes target     prot opt in     out     source               destination
...
2584   103392 DROP       all  --  enp1s0 *       79.124.0.0/18        0.0.0.0/0
...

Observe the rule has been hit 2584 times.

EDIT: By the way, I use the following method to find the worst players from the previous day (not including the ones I already specifically DROP):

doug@s15:~$ tail -20000 /var/log/syslog.1 | sed 's/ /\n/g' | grep "SRC=" | cut -d"." -f1,2,3,4 | sort | uniq -c | sort -g | tail -4
    265 SRC=51.38.110.114
    392 SRC=195.230.23.151
    621 SRC=98.166.24.100
    855 SRC=130.211.9.161
doug@s15:~$ tail -20000 /var/log/syslog.1 | sed 's/ /\n/g' | grep "SRC=" | cut -d"." -f1,2,3 | sort | uniq -c | sort -g | tail -4
    392 SRC=195.230.23
    429 SRC=162.142.125
    621 SRC=98.166.24
    855 SRC=130.211.9
doug@s15:~$ tail -20000 /var/log/syslog.1 | sed 's/ /\n/g' | grep "SRC=" | cut -d"." -f1,2 | sort | uniq -c | sort -g | tail -4
    429 SRC=162.142
    486 SRC=192.241
    621 SRC=98.166
    855 SRC=130.211

Note: I use tail because I often only search the last few hundred lines.

Please, for your next question, give us more information to work with.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .