#
# A sample configuration file for swatch.
#
# See "man swatch" for details.

# Mails root when invalid remote login attempted.
watchfor /(.*) (.*) (.*) (.*) (.*):( [iI]nvalid [uU]ser )(.*)( from )(.*)$/
	threshold track_by=$9,type=limit,count=3,seconds=30
	mail root,subject="Invalid user"