threshold 550; ignore { 127.0.0.0/8; // localhost }; // file "/var/log/cisco.log" { // pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" { // index 2; // zero based // bucket 200; // }; // }; file "/var/log/secure" { pattern "sshd.*Failed password .* from ::ffff:(.*) port" { index 1; // zero based bucket 400; }; pattern "sshd.*Failed password .* from (.*) port" { index 1; // zero based bucket 400; }; }; file "/var/log/httpd/access_log" { pattern "(.*) - - .* /cgi-bin" { index 1; // zero based bucket 400; }; pattern "(.*) - - .*/index2.php" { index 1; // zero based bucket 400; }; pattern "(.*) - - .*/main.php" { index 1; // zero based bucket 400; }; }; // file "/var/log/messages" { // pattern "sshd.pam_unix.*authentication failure.*rhost=(.*) user=" { // index 1; // zero based // bucket 300; // }; // pattern "sshd.pam_unix.*authentication failure.*rhost=(.*)$" { // index 1; // zero based // bucket 300; // }; // };