ACZoom

So in my log (/var/log/secure) it says when there are failed login attempts. When the failed attempt is with a user that does not exist, this is logged
Dec 31 13:27:30 Server vsftpd: pam_unix(vsftpd:auth): check pass; user unknown
Dec 31 13:27:30 Server vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.1.1
Dec 31 13:27:30 Server vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user asdf

I think that middle line is the important one though. When the user is put in, but wrong password this is logged

Dec 31 13:31:43 Server vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=192.168.1.1 user=Test

What would the Regular expression be to make blockhosts work with this?

thank you very much