# Das OS: ban addresses that keep failing SSH logins, through nftables.
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports

[sshd]
enabled = true
backend = polling
# socklog-void collects auth messages here. svlogd starts each line with a
# UTC time stamp; the pattern also consumes the facility and the syslog date
# that follow it, so the sshd filter sees "sshd-session[pid]: ...":
# 2026-10-19T17:25:46.09500 auth.info: Oct 19 20:25:46 sshd-session[1154]: Invalid user ...
logpath = /var/log/socklog/secure/current
datepattern = ^%%Y-%%m-%%dT%%H:%%M:%%S\.%%f(?: \S+: \S+ +\d+ \S+)?
logtimezone = UTC