date >> ssh-intruders.log ; cat /var/log/secure | grep -i "sshd.*authentication failure" | sort | awk '{FS="rhost="; print $2}' | awk '{FS="user="; print $1}' | grep ".*\..*\." | grep -v "knownhost.com" | grep -v "knownhost2.com" | sort | uniq | while read i; do counter=`grep -i "$i" /var/log/secure | wc -l` ; echo "$counter attempts by $i"; done >> ssh-intruders.log ; cat ssh-intruders.log