+++ /dev/null
-**Phase 1: Completed pre-decoding.
- full event: 'Nov 11 22:46:29 localhost vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4'
- hostname: 'localhost'
- program_name: 'vsftpd'
- log: 'pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4'
-
-**Phase 2: Completed decoding.
- decoder: 'pam'
- srcip: '1.2.3.4'
-
-**Phase 3: Completed filtering (rules).
- Rule id: '5503'
- Level: '5'
- Description: 'User login failed.'
-**Alert to be generated.
-
-