Code: Select all
5.17.159.141 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
211.192.213.10 # #maually added by Infopro - Sun Apr 4 12:24:26 2010
One line was added automatically by CSF, the other manually as noted when added.
But, if there are several lines that were auto added, take the example above with one added line like this:
Code: Select all
5.17.159.141 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
211.192.213.10 # #manually added by Infopro - Sun Apr 4 12:24:26 2010
11.192.213.10 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
Code: Select all
5.17.159.141 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
.192.213.10 # lfd: 5 (sshd) login failures from 85.17.159.141 (NL/Netherlands/hosted-by.leaseweb.com) in the last 300 secs - Sun Apr 4 11:05:20 2010
I hope that makes some sense. Note that in my example I did reuse a line with a different IP at the front end of the line for example purposes only, hence the same mesage on tail end of line.