gentoo-overlay/app-admin/swatchdog/files/swatchdogrc

#
# A sample configuration file for swatchdog.
#
# See "man swatchdog" for details.

# Mails root when invalid remote login attempted.
watchfor /(.*) (.*) (.*) (.*) (.*):( [iI]nvalid [uU]ser )(.*)( from )(.*)$/
	threshold track_by=$9,type=limit,count=3,seconds=30
	mail root,subject="Invalid user"