2007-09-12-ssh-log-monitoring-and-alerting.pl

use File::Tail;

my @errors = (’Bad protocol version identification’,'Failed password’,'Did not receive identification string’);
my $line;
my $file = File::Tail->new(”/var/log/auth.log”);

while (defined($line=$file->read)) {
    if ($line =~ /$errors[0]|$errors[1]|$errors[2]/) {
        open(SSHALERT, “>/tmp/sshalert.txt”);
        print SSHALERT “$line”;
        system (’mplayer some_loud_audio_file.mp3′);
        system (’mutt -s ALERT-SSH -c someuser@somedomain.com < /tmp/sshalert.txt’);
    }
}