#!/bin/perl

use strict;
use warnings;

my $current_time = localtime;

my $check_journal="/var/tmp/check_journal.log";
open(my $cj, '>>', $check_journal) or die  $!;

my $logprevfile="/var/tmp/logprev.txt";
my $logprev;
# if file exists
if (-s $logprevfile) {
    open(my $fi, '<', $logprevfile) or die $!;
       $logprev=<$fi>;
    close($fi);
} else {
    $logprev=0;
}
# if not make $logprev zero
   print $cj "$current_time\n";
   print $cj "logprev=$logprev\n";

my $logcount=`/usr/bin/journalctl -u ssh | wc -l`;
   chomp($logcount);

   print $cj "logcount=$logcount\n";
   if ($logcount > $logprev) {

       my $total = $logcount - $logprev;
       # print "Total=$total\n";
       my @output=`/usr/bin/journalctl -u ssh | tail -$total`;
       # print @output;
       my $oldip="0.0.0.0";
       foreach (@output) {
              chomp;
              if (($_ =~ /Unable|Connection|Disconnected/) && ($_ !~ /xxxxxxx/)) {
              #  if ((/Failed/) || (/Timeout/)) {
                  # print "$_\n";
                  if ($_ =~ m/\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/) {
                      my $ip = $1;
                      if ($ip ne $oldip) {
                           my $result=`/usr/bin/curl -sS -H "Authorization: Bearer dxxxxxxxxxx8" https://api.ipinfo.io/lite/$ip | /usr/bin/grep 'country\":' | /usr/bin/awk -F: '{print \$2}'`;
                           print $cj "ipset this: $ip $result";
                           $result=`/usr/sbin/ipset add scammer $ip`;
                           $oldip=$ip;
                      }
                  }
              }
       }
       $logprev = $logcount;
       open(my $fo, '>', $logprevfile) or die $!;
          print $fo $logprev;
       close($fo);
   }
my $result=`/usr/sbin/ipset list scammer | /usr/bin/grep Number`;
print $cj "$result\n";
close($cj);