Use -f option for zcat example

README.md

@@ -0,0 +1,17 @@
+# Fail2ban Analyze
+
+Analyze fail2ban logs to find most common ip's and plot histogram of access rates.
+
+## Example usage
+Plot the histogram of the access hits
+```
+zcat -f /var/log/fail2ban.log* | ./fail2ban-analyze.py histogram
+```
+Rank IPs by bans, first 20 results
+```
+zcat -f /var/log/fail2ban.log* | ./fail2ban-analyze.py rank 4 --only-bans --count 20
+```
+Rank all IPs by bans, clobber by first 2 subnets
+```
+zcat -f /var/log/fail2ban.log* | ./fail2ban-analyze.py rank 2 --only-bans --count 20
+```

fail2ban-analyze.py

@@ -75,7 +75,9 @@ else:
     num_buckets = (max_date - min_date).total_seconds() / (bucket_size * 3600)
     num_buckets = max(1, int(num_buckets))
     counts, bin_edges = np.histogram(timestamps, bins=num_buckets)
+    ts_edges = [datetime.fromtimestamp(t) for t in bin_edges]
+    labels = [x[0].strftime('%Y-%m-%d %H:%M - ') + x[1].strftime('%Y-%m-%d %H:%M') for x in zip(ts_edges[:-1], ts_edges[1:])]
     fig = tpl.figure()
-    fig.hist(counts, bin_edges)
+    fig.barh(counts, labels)
     fig.show()