1**Phase 1: Completed pre-decoding. 2 full event: 'Nov 11 22:46:29 localhost vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4' 3 hostname: 'localhost' 4 program_name: 'vsftpd' 5 log: 'pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=1.2.3.4' 6 7**Phase 2: Completed decoding. 8 decoder: 'pam' 9 srcip: '1.2.3.4' 10 11**Phase 3: Completed filtering (rules). 12 Rule id: '5503' 13 Level: '5' 14 Description: 'User login failed.' 15**Alert to be generated. 16 17 18