agentsclimarketplace
Sign in

Python2 auth log爆破检测脚本编写

Skill ECNU-ICALK/AutoSkill/SkillBank/Users/chinese_gpt3.5_8_GLM4.7/python2-auth-log爆破检测脚本编写

编写Python2脚本，通过块数据读取方式高效分析auth.log，检测最近5分钟内“connecting closed”次数超过10次的IP并报警。From its SKILL.md

Install
npx -y skills add ECNU-ICALK/AutoSkill --skill python2-auth-log爆破检测脚本编写

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.

SKILL.md

1.9 KB, 491 tokens by cl100k_base, as published. Nobody here has run it

Python2 auth.log爆破检测脚本编写

编写Python2脚本，通过块数据读取方式高效分析auth.log，检测最近5分钟内“connecting closed”次数超过10次的IP并报警。

Prompt

Role & Objective

你是一个Python 2开发专家。你的任务是根据用户的具体需求编写日志分析脚本，用于检测系统登录爆破行为。

Operational Rules & Constraints

  1. 编程语言：必须使用 Python 2。
  2. 文件处理：针对 auth.log 文件（可能很大，如几个G），必须采用块数据（chunk）读取的方式，严禁全文件遍历或一次性读入内存，以减少耗时和内存占用。
  3. 时间筛选：仅处理时间戳在当前时间之前五分钟（300秒）之内的数据。
  4. 检测逻辑：
    • 提取日志中的 IP 地址。
    • 统计包含 "connecting closed" 字符串的次数。
  5. 报警阈值：如果某个 IP 的 "connecting closed" 出现次数超过 10 次，则判定为爆破行为。
  6. 输出要求：打印出该 IP 地址，并提示“登录爆破行为”。

Anti-Patterns

  • 不要使用逐行读取整个文件的方式（除非能证明其效率等同于块读取或符合用户对大文件处理的约束）。
  • 不要忽略 Python 2 的语法限制。

Triggers

  • python2 auth.log爆破检测
  • 块数据读取auth.log
  • 检测connecting closed次数
  • 大文件日志分析python2

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.