diff --git a/app/module/SSHMonitor.py b/app/module/SSHMonitor.py index d16dfc9..4cfb407 100644 --- a/app/module/SSHMonitor.py +++ b/app/module/SSHMonitor.py @@ -11,35 +11,33 @@ def ssh_monitr(): '''监控 ssh 的失败登录日志''' - ssh_fp = open('./output/analyse/ssh_analyse', 'r') - raw_data = ssh_fp.readlines() - ssh_fp.close() raw_lst = list() - for i in raw_data: - raw_lst.append(loads(i)) + + with open('./output/analyse/ssh_analyse', 'a+') as ssh_fp: + raw_data = ssh_fp.readlines() + for i in raw_data: + raw_lst.append(loads(i)) - ssh_fp = open('./output/analyse/ssh_analyse', 'w') - # 执行统计命令 - stream = os.popen(cmd) - # 获取执行结果 - output = stream.read().split() - stream.close() - length = len(output) - if length % 2 == 0: - for i in range(0, length, 2): - cot = int(output[i]) - if cot > 50: - info = dict() - info['count'] = output[i] - info['srcIP'] = output[i + 1] - info['evilType'] = 107 - for each_d in raw_lst: - if each_d == info: - print('eq') - continue - evillink = [info['srcIP'], '', 107] - # 以json格式写入文件 - ssh_fp.write(dumps(info) + '\n') - with open('./output/evillink_status.log', 'a') as f: - f.write(dumps(evillink) + '\n') - ssh_fp.close() + # 执行统计命令 + stream = os.popen(cmd) + # 获取执行结果 + output = stream.read().split() + stream.close() + length = len(output) + if length % 2 == 0: + for i in range(0, length, 2): + cot = int(output[i]) + if cot > 50: + info = dict() + info['count'] = output[i] + info['srcIP'] = output[i + 1] + info['evilType'] = 107 + for each_d in raw_lst: + if each_d == info: + print('eq') + continue + evillink = [info['srcIP'], '', 107] + # 以json格式写入文件 + ssh_fp.write(dumps(info) + '\n') + with open('./output/evillink_status.log', 'a') as f: + f.write(dumps(evillink) + '\n')