grep -i "failed password" /var/log/secure | awk '{if ($11 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) print $11 ; else print $13 }' | uniq -c | sort -nr -k1 > ~ip.txt

查看 ip.txt 文件结果

[root@dameng ~]# cat \~ip.txt 
    243 36.137.179.205
    212 36.137.181.204
    169 58.48.30.106
    144 1.92.144.173
     54 36.137.179.205
     32 1.92.144.173
     30 123.59.28.66
     10 8.218.185.11
      9 2.57.122.162
      9 192.109.206.98
      7 180.76.105.165
      7 111.67.194.86
      ……
      ……
      ……

部分日志截取

Apr 22 01:19:27 dameng sshd[8375]: Failed password for root from 188.17.143.44 port 62412 ssh2
Apr 22 01:19:28 dameng sshd[8379]: Failed password for invalid user postgres from 170.64.224.35 port 51868 ssh2

IP有可能在11列或者13列，所以需要增加一个正则表达式的判断。