Monitoring IPs connecting to OpenVPN

daq

I wrote a simple script to monitor openvpn.log for any new IPs and send a report if one is found. This way I know when a user connects from a new location and can quickly find out if that's a legitimate connection or if account has been compromised.

Unfortunately my script occasionally misses the first digit from an IP address which creates false alarms and I can't figure out why. Script is below:


for IP in $(grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' /var/log/openvpn.log)
do
        if ! grep -Fxq $IP /tmp/knownIPs.txt
        then
                echo New IP detected: $IP
                echo GeoIP: $(/usr/local/bin/php -f /root/geoIdent.php $IP)
                echo User: $(grep -m1 $IP /var/log/openvpn.log | cut -d[ -f3|cut -d] -f1)
                echo $IP >> /tmp/knownIPs.txt
        fi
done

For example, an IP like 71.160.14.214 will get picked up like 1.160.14.214. One is in California, one is in Taiwan.

I ran the grep command from the script manually many times and I can never replicate this problem - it consistently picks up the complete IP address.

Any ideas? Thanks!