file "/var/log/messages" {
  syslog =1;
  type "failed su(1) attempt" {
    match = "BAD SU %USER:FROM% to %USER:TO% on %TTY%";
    reaction = "echo 'Failed su(1): %USER:FROM% -> %USER:TO% (%TTY%)'";
  };
  type "ftp repeat offender" {
    match = "FTP LOGIN FAILED FROM %IP";
    threshold = "10";
    reaction = "ipfw -q table 1 add %IP%";
  };
};