syslog "info", "spammer trying dictionary attack blocking  $ipaddr";