1**Phase 1: Completed pre-decoding.
2       full event: 'Nov 11 22:46:29 localhost vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4'
3       hostname: 'localhost'
4       program_name: 'vsftpd'
5       log: 'pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4'
6
7**Phase 2: Completed decoding.
8       decoder: 'pam'
9       srcip: '1.2.3.4'
10
11**Phase 3: Completed filtering (rules).
12       Rule id: '5503'
13       Level: '5'
14       Description: 'User login failed.'
15**Alert to be generated.
16
17
18