1st add for sshbruted

sshbruted.rb

@@ -0,0 +1,9 @@
+
+regexp = /(.+).+mailsystem sshd\[\d+\]: Failed ([\A ]+) for ([\A\s]+) from ([\d\.]+) port (\d+) ssh2/
+match = regexp.match(subject)
+if match
+	result = match[1]
+else
+	result = ""
+end
+

test.log

@@ -0,0 +1,10 @@
+Mar  3 18:56:21 mailsystem sshd[19738]: Failed password for root from 125.251.21.2 port 46065 ssh2
+Mar  3 18:56:23 mailsystem sshd[19740]: Failed password for root from 125.251.21.2 port 46211 ssh2
+Mar  3 18:56:25 mailsystem sshd[19742]: Failed password for root from 125.251.21.2 port 46373 ssh2
+Mar  3 18:56:26 mailsystem sshd[19744]: Failed password for root from 125.251.21.2 port 46531 ssh2
+Mar  3 18:56:28 mailsystem sshd[19746]: Failed password for root from 125.251.21.2 port 46700 ssh2
+Mar  3 18:56:30 mailsystem sshd[19748]: Failed password for root from 125.251.21.2 port 46849 ssh2
+Mar  3 18:56:31 mailsystem sshd[19750]: Failed password for root from 125.251.21.2 port 47010 ssh2
+Mar  3 18:56:33 mailsystem sshd[19752]: Failed password for root from 125.251.21.2 port 47161 ssh2
+Mar  3 21:53:15 mailsystem sshd[20090]: Accepted password for swaits from 66.27.52.246 port 51310 ssh2
+Mar  3 21:53:26 mailsystem su: swaits to root on /dev/ttyp0