:msg, contains, "BLOCKED-SSH" -/var/log/blocked-ssh.log & ~