BASH sorting of brute force attempts

sorting_auth_data.sh

# finding authentication errors in all message log files
grep -r "authentication error" messages* | awk '{split($0,a," "); print a[NF],a[NF-2]}' > attempts

# username
cut -d ' ' -f2 attempts | sort -k 2,2 | uniq -c | sort -nr > attempts_username

# IP
cut -d ' ' -f1 attempts | sort | uniq -c | sort -nr > attempts_ip

GEOIP - location for an IP example
curl -s "http://www.geody.com/geoip.php?ip=222.186.9.52" | sed '/^IP:/!d;s/<[^>][^>]*>//g' | awk '{split($0,a,":"); print a[2]}'