Agentsmith
Monitor Log Files for Anomalies
Agentsmith is a daemon that continuously monitors a log file for break-in attempts by remote hosts. Upon detection of a break-in attempt, it launches a user defined script or application, which can do virtually anything from sending mails to whatever you might think of.
The criteria what is considered a break-in attempt can be configured by means of a regular expression.