#6 Usefull Regex Expressions

[Pedro Algarvio]

On your conf, you should have some usefull regex
expressions, like so, you should add to the ones you have:
|(error: PAM: Authentication failure for illegal user)
(.*) (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$(Failed
keyboard-interactive) (.*) from
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$|(authentication
failure;) (.*)
rhost=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$|(Failed
password for invalid user|Failed password for) (.*)
from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (port
\d+|port \d+ ssh2)|(Authentication failure for illegal
user) (.*) -
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$|(illegal user)
(.*) from
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$|(Authentication)
failure;(.*) rhost=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
user=(.*)$|(Invalid user) (.*) from
(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

This is something good, or at least usefull...