This kind of log: (I need a grok pattern to extarct the IP and user... And i want check it whether it is a password failure.)
Sep 18 15:54:25 ama