feed authpicious /var/log/auth.log on stdin and watch it rank offenders by offense.
authpicious
/var/log/auth.log
$ go get mcquay.me/authpixious
$ cat /var/log/auth.log | authpixious -max 10