Hacker News Reader

None. It is the attacks that don't get banned that you want to know about.

On this topic does anyone know if there is something simple that will tell you if a new IP address logs in or a new process is started?

For new IP addresses, you can write a script to monitor your auth.log file.

I agree, what I do instead is track the number of currently banned with nagios and if it goes over a specific threshold I get a warning. With PNP4Nagios you also get a nice graph over time.

I have them in a quiet channel without notifications just to amuse myself. I have not nearly that much tho