CODEWITHSUNDEEP
powershell
Trey Nuckolls
Trey Nuckolls

Reputation: 591

Combining like objects in an array

I am attempting to analyze a group of text files (MSFTP logs) and do counts of IP addresses that have submitted bad credentials. I think I have it worked out except I don't think that the array is passing to/from the function correctly. As a result, I get duplicate entries if the same IP appears in multiple log files. What am I doing wrong?

Function LogBadAttempt($FTPLog,$BadPassesArray)
    {
    $BadPassEx="PASS - 530"
    Foreach($Line in $FTPLog)
        {
        if ($Line -match $BadPassEx)
            {
            $IP=($Line.Split(' '))[1]
            if($BadPassesArray.IP -contains $IP)
                {
                $CurrentIP=$BadPassesArray | Where-Object {$_.IP -like $IP}
                [int]$CurrentCount=$CurrentIP.Count
                $CurrentCount++
                $CurrentIP.Count=$CurrentCount
                }else{
                $info=@{"IP"=$IP;"Count"='1'}
                $BadPass=New-Object -TypeName PSObject -Property $info
                $BadPassesArray += $BadPass
                }
            }
        }
    return $BadPassesArray
    }
$BadPassesArray=@()
$FTPLogs = Get-Childitem \\ftpserver\MSFTPSVC1\test
$Result = ForEach ($LogFile in $FTPLogs)
    {
    $FTPLog=Get-Content ($LogFile.fullname)
    LogBadAttempt $FTPLog
    } 
$Result | Export-csv C:\Temp\test.csv -NoTypeInformation

The result looks like...

Count   IP
7   209.59.17.20
20  209.240.83.135
18441   209.59.17.20
13059   200.29.3.98

and would like it to combine the entries for 209.59.17.20

Upvotes: 0

Views: 94

Answers (1)

Ansgar Wiechers
Ansgar Wiechers

Reputation: 200293

You're making this way too complicated. Process the files in a pipeline and use a hashtable to count the occurrences of each IP address:

$BadPasswords = @{}

Get-ChildItem '\\ftpserver\MSFTPSVC1\test' | Get-Content | ? {
  $_ -like '*PASS - 530*'
} | % {
  $ip = ($_ -split ' ')[1]
  $BadPasswords[$ip]++
}

$BadPasswords.GetEnumerator() |
  select @{n='IP';e={$_.Name}}, @{n='Count';e={$_.Value}} |
  Export-Csv 'C:\Temp\test.csv' -NoType

Upvotes: 3

Related Questions