#! /usr/pkg/pin/perl

while (<>) {
    #     1       2                                        3
    if (/(\w+)\s+(\d+) [\d:]+ .* sshd\[\d+\]: Invalid user (\w+)\s+from ([\d\.]+)/) {
	$month = $1;
	$date  = $2;
	$user  = $3;
	$ip    = $4;
	push(@list,[$month,$host,$user,$ip]);
	$COUNT{$ip}{$user}++;
    }
}
#  foreach $i (sort {$a->[3] cmp $b->[3]} @list) {
#      printf("%s %s %s %s\n",
#  	$i->[3],
#  	$i->[2],
#  	   $i->[0],);
#  }

foreach $i ( sort keys %COUNT ) {
    my $c = 0;
    printf("%-15s ", ''.$i.'');
    foreach  $j ( sort keys %{$COUNT{$i }} ) {
#       printf("%-20s %5d \n", $j,$COUNT{$i}{$j});
	$c += $COUNT{$i}{$j};
    }
#    printf("%-10s %5d \n", 'TOTAL',$c);
    printf("%1s %5d \n", '',$c);

}
        

__END__
Oct 18 03:05:49 kurobsd sshd[26736]: Invalid user library from 211.75.142.106