'^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[([[:digit:]]+)\]: .*' - - - 0 continue open "$2" - 5000 86400 3600 report "/bin/cat" "$2" '^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[([[:digit:]]+)\]: Failed password .*' - - - 0 report "/bin/cat" "$2" '^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[([[:digit:]]+)\]: Connection closed.*' - - - 0 delete "$2"