monitorFailedSshAuth.pl

#!/usr/bin/perl

use strict;
use File::Tail;

my @errors = ('Bad protocol version identification','Failed password','Did not receive identification string');
my $line;
my $file = File::Tail->new("/var/log/everything.log");

while (defined($line=$file->read)) {
        if ($line =~ /$errors[0]|$errors[1]|$errors[2]/) {
                open(SSHALERT, ">/tmp/sshalert.txt");
                print SSHALERT "$line";
                #system ('mplayer /etc/scripts/burglar.mp3');
                system ('mutt -s ALERT-SSH -c me@yourmomma.com < /tmp/sshalert.txt');
        }
}