I do this with a program called fail2ban. You configure it to watch log files for authentication failures or other suspicious activity. It then blocks the suspicious source IP in iptables for the configured period of time. When the time expires, the IP is unbanned, so false positives or new users of an IP address aren't adversely affected. I get many bans per day and don't put much energy into monitoring or reporting them. Tom KD7LXL _________________________________________