threshold 600;

ignore {
    127.0.0.0/8;        // localhost
    205.147.40.32/26;   // 510sg
    205.147.0.100/24;   // digilink
    205.147.39.128/25;  // ams
};

file "/var/log/cisco.log" {
    pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" {
        index 2;    // zero based
        bucket 200;
    };
};

file "messages.log" {
    pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" {
        index 1;    // zero based
        bucket 300;
    };
    pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" {
        index 1;    // zero based
        bucket 300;
    };
};