Python › Module 3 › Lesson 4
Lab — Build a Log Analyzer
Build a small analyzer that summarizes failed auth lines from a sample log file
Opening
From lines to a mini report
Reuse sample_auth.log (or recreate it). Build an analyzer that counts failures and prints top source IPs.
1. log_analyzer.py
Failed-login analyzer — copy & runimport re from collections import Counter path = "sample_auth.log" ip_re = re.compile(r"from (\\d+\\.\\d+\\.\\d+\\.\\d+)") fails = Counter() with open(path, encoding="utf-8", errors="ignore") as f: for line in f: if "Failed password" not in line: continue m = ip_re.search(line) if m: fails[m.group(1)] += 1 print("Unique attacker IPs:", len(fails)) for ip, n in fails.most_common(): print(f"{ip:16} {n}")
import re
from collections import Counter
path = "sample_auth.log"
ip_re = re.compile(r"from (\\d+\\.\\d+\\.\\d+\\.\\d+)")
fails = Counter()
with open(path, encoding="utf-8", errors="ignore") as f:
for line in f:
if "Failed password" not in line:
continue
m = ip_re.search(line)
if m:
fails[m.group(1)] += 1
print("Unique attacker IPs:", len(fails))
for ip, n in fails.most_common():
print(f"{ip:16} {n}")Runpython log_analyzer.py python3 log_analyzer.py
python log_analyzer.py python3 log_analyzer.py
Complete log analyzer lab
Create/reuse sample_auth.log, run log_analyzer.py, and list the top IPs by failed password count.
Knowledge Check
Counter helps you:
Multiple choice
Knowledge Check
True or False: Regex can extract IPs from auth log lines.
True or False