Following assume you use Dovecot

• find all the IP's a user connects from to check dovecot mail with number of connections for each
  

  grep 'dovecot:' /var/log/mail.log | grep 'Login:' | grep 'rip=' | cut -d',' -f3 | cut -d'=' -f2 | sort | uniq -c

• find all protocols a user connects from to check dovecot mail, with number of connections
  

  grep 'dovecot:' /var/log/mail.log | grep 'Login:' | cut -d':' -f4 | cut -d'-' -f1 | sort | uniq -c

• Get a list of all banned sites with the jails that banned them from fail2ban with number of hits (gives you a list of IP's that are hitting you a lot)
  

  # limit by date
  grep '2014-02-2' fail2ban.log | grep 'Ban' | cut -d' ' -f5,7 | sort | uniq -c | sort
  # dump the whole log file
  grep 'Ban' fail2ban.log | cut -d' ' -f5,7 | sort | uniq -c | sort
  

• Block all UDP traffic with IPTables
  

  iptables -A INPUT -p udp -j DROP
  iptables -A OUTPUT -p udp -j DROP
  # to disable, issue this command
  iptables -D OUTPUT -p udp -j DROP
  

• As above, but allow DNS via port 53, see http://stackoverflow.com/questions/11064248/block-all-udp-traffic-except-dns-using-iptables
  

  iptables -A INPUT -p udp --sport 53 -j ACCEPT
  iptables -A INPUT -p udp --dport 53 -j ACCEPT
  iptables -A OUTPUT -p udp --sport 53 -j ACCEPT
  iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
  iptables -A INPUT -p udp -j DROP
  iptables -A OUTPUT -p udp -j DROP
  

• Block someone who is attacking you via iptables
  

  iptables -A INPUT -s address.of.bad.guy -j DROP
  

• find all .bak files in the samba share and determine total space used by them

  find samba/ -type f -iname '*\.bak' -exec du -Bk \{\} \; | cut -dK -f1| paste -sd+ - | bc
  

• This is in three parts. First, we use find to locate all *.bak files (case insensitive), then have it run the du command on them. Using -Bk means the output will all be in kilobytes
• Then, we pass the output of that to cut, parsing only the numbers before the 'K' that du puts after the number, so we have a stream of integers, one per line.
• Now, pass that to paste, which will concatenate all ines together, separated by a delimiter (a plus sign in this case). paste normally wants a file, but using the trailing - tells it to take its input from STDIN
• At this point, we have a formula, fs1+fs2+fs3, which we simply pass to bc. It calculates the results of the formula, and prints the result on the output.
• As above, but also count the number of files. Warning: This only works in bash, zsh and ksh. Will not work in dash or sh (or bash in sh mode)

  find samba/ -type f -iname '*\.bak' -exec du -Bk \{\} \; | cut -dK -f1| tee >(wc>/tmp/a) | paste -sd+ - | bc ; cat /tmp/a
  

• Here, we've added the tee command so we can pass it to wc. Since the output of wc will not go to the output, but instead be passed to paste, we redirect the output to /tmp/a, then cat that file when done.
• NOTE: if /tmp/a exists, it is overwritten without notification.
• http://unix.stackexchange.com/questions/28503/how-can-i-send-stdout-to-multiple-commands
• Find the oldest file in a directory tree

  find -type f -printf '%T+ %p\n' | sort | head -n 1 # oldest
  find -type f -printf '%T+ %p\n' | sort -r | head -n 1 # newest

  http://superuser.com/questions/552600/how-can-i-find-the-oldest-file-in-a-directory-tree#552606