Auth log parsing for failed ssh attempts

auth_fail.rb

#!/usr/bin/env ruby
#This script requres a MaxMind GeoIP database.
#I tested with the database from: http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
require 'geoip'
require 'json'

#Format
# 0 => Month 1 => Day 2 => Time 3 => host 4=> proc 7=> username 9 => IP
USER_COL = 7
IP_COL = 9
geo = GeoIP.new('GeoLiteCity.dat')
ips = Hash.new()
visitors = Array.new()
ARGF.each do |line|
  if line.include?("Invalid user")

     chunks = line.split(' ')
    ip = chunks[IP_COL]
    username = chunks[USER_COL]

    if ips.has_key?ip
      ips[ip][:count]+=1
      if ips[ip][:usernames].has_key?username
        ips[ip][:usernames][username]+=1
      else
        ips[ip][:usernames][username] = 1
      end
    else
      city = geo.city(ip).to_hash
      ips[ip] = {:count => 1,:city => city[:city_name], :country => city[:country_name], :usernames => { username => 1 }}
    end
  end
end

puts ips

File.open("ssh_attackers.json", 'w') {|f| f.write(ips.to_json) }