linux – log failed log attempts in centos 7

I’m trying to make a loop that searches all the logs for failed connections from the previous day and redirects the output to a text file.but the result I get is always the same and it’s the failed connections from a few days ago while I just want all the type of failed connections from the previous day. when the day change… new results

#!/bin/bash

for d in /var/log/syslog/*/; do

        for f in "$d*"; do

                cat -n $f | grep "authentication failure" >> failed.txt
                journalctl _SYSTEMD_UNIT=sshd.service | egrep "Failed|Failure" >> failed.txt
                journalctl _SYSTEMD_UNIT=ssh.service | egrep "Failed|Failure" >> failed.txt
                ##journalctl _SYSTEMD_UNIT=sshd.service | grep "failure" >> failed.txt
                cat $f | grep "FAILED LOGIN" >> failed.txt

        done

done

As result i get :

022-11-28T21:11:30.459739-05:00 localhost login: FAILED LOGIN 1 FROM tty3 FOR syslog, Authentication failure
2022-11-28T21:32:46.975878-05:00 localhost login: FAILED LOGIN 1 FROM tty3 FOR syslog, Authentication failure
2022-11-28T20:49:40-05:00 syslog login[2544]: FAILED LOGIN (1) on ‘/dev/tty3’ FOR ‘syslog’, Authentication failure

Read more here: Source link