to track VPN login attempts, the only log we have is in /var/log/messages and is multilined:
Jan 27 07:50:22 server pppd[6458]: No CHAP secret found for authenticating admin
Jan 27 07:50:22 server pppd[6458]: Peer admin failed CHAP authentication
Jan 27 07:50:23 server pppd[6458]: Connection terminated.
Jan 27 07:50:23 server pppd[6458]: Exit.
Jan 27 07:50:23 server pptpd[6457]: GRE...
2009-01-27 16:52:30 UTC in Fail2Ban
