package hmm import ( "regexp" ) // Failed password for root from 43.229.53.57 port 62954 ssh2 // message repeated 2 times: [ Failed password for root from 43.229.53.57 port 32871 ssh2] var p = regexp.MustCompile(`Failed password for .* from (.*) port`) // ParseIP finds the ip address from an sshd log line that contains a failed // password attempt. func ParseIP(line string) string { if m := p.FindStringSubmatch(line); m != nil { if len(m) != 2 { return "" } return string(m[1]) } return "" }