title: Python Script to find IP address with more than 30 attacks
body: <p>I am trying to create a Python script that allows me to search through an <code>auth.log</code> file and search for IP Address with more than 30 failed attempts then create a blacklist file where those IP Address would then be saved. This is what I have so far but the regular expression doesn't seem to work:</p>
  
  <pre><code>#!/usr/bin/python
  import re # allows me to use regular expressions 
  
  #attempts = 0 #setting the variable 'attempts' to 0
  myAuthlog=open('auth.log', 'r') #open the auth.log for reading
  
  #open the Security_Test.txt for writing later
  myTxtFile = open('blacklistips.txt','w')
  
  #write to the file what we are analysing
  myTxtFile.write('The security options for httpd.conf\n')
  
  for line in myAuthlog: #go through each line of the file and return it to the variable line
      if re.match("([0-9]{1,3}\.){3}[0-9]{1,3}$'", line): #if the regular expressions matches 'bin' or 'Bin' in line
  </code></pre>
  
  <p>An example from the log file is:</p>
  
  <pre class="lang-none prettyprint-override"><code>Feb  5 08:34:51 j4-be02 sshd[2281]: Failed password for root from 5.199.133.223 port 42582 ssh2
  Feb  5 08:34:56 j4-be02 sshd[2283]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.199.133.223  user=root
  Feb  5 08:34:58 j4-be02 sshd[2283]: Failed password for root from 5.199.133.223 port 50099 ssh2
  Feb  5 08:35:04 j4-be02 sshd[2285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.199.133.223  user=root
  </code></pre>
  
  <p>i need to search through this file and find all the IP Addresses and <code>authentication failure</code> and if there are more than 30 failures those IP Address get written to a text file.</p>