Munin plugin for measure ssh invalid user

ssh_invalid

#!/bin/sh
# -*- sh -*-

: << =cut

=head1 NAME

ssh_invalid - Plugin to measure invalid ssh user.

=head1 AUTHOR

Contributed by hogelog

=head1 LICENSE

GPLv2

=head1 MAGIC MARKERS

 #%# family=auto
 #%# capabilities=autoconf

=cut

. $MUNIN_LIBDIR/plugins/plugin.sh

if [ "$1" = "autoconf" ]; then
        echo yes
        exit 0
fi
if [ "$1" = "config" ]; then

        echo 'graph_title SSH Invalid User'
        echo 'graph_args --base 1000 -l 0 '
        echo 'graph_scale no'
        echo 'graph_vlabel invalid user in days'
        echo 'graph_category system'
        echo 'ssh_invalid.label invalid_user'
        echo 'ssh_invalid.draw AREA'
        print_warning ssh_invalid
        print_critical ssh_invalid
        exit 0
fi

SSH_LOG=${sshlog:-/var/log/auth.log}
MON=`LANG=C date '+%b'`
DAY=`date '+%d'`
TODAY=`printf "%s %2d" $MON $DAY`
COUNT=`grep "$TODAY" $SSH_LOG | grep "invalid user" | wc -l`
printf "ssh_invalid.value $COUNT\n"