The syslog2iptables.conf configuration file is specified by this partial bnf description.
CONFIG := {THRESHOLD | IGNORE | FILE}+ THRESHOLD := "threshold" THRESHOLD-INTEGER-VALUE ";" IGNORE := "ignore" "{" IG-SINGLE+ "};" IG-SINGLE := IP-ADDRESS "/" CIDR-BITS ";" FILE := "file" FILENAME "{" PATTERN+ "};" PATTERN := "pattern" REGULAR-EXPRESSION "{" {INDEX | BUCKET}+ "};" INDEX := "index" REGEX-INTEGER-VALUE ";" BUCKET := "bucket" BUCKET-ADD-INTEGER-VALUE ";"
threshold 550; ignore { 127.0.0.0/8; // localhost }; file "/var/log/cisco.log" { pattern "Internet_Firewall denied (tcp|udp) ([^(]*)" { index 2; // zero based bucket 200; }; }; file "/var/log/secure" { pattern "sshd.*Failed password .* from ::ffff:(.*) port" { index 1; // zero based bucket 400; }; pattern "sshd.*Failed password .* from (.*) port" { index 1; // zero based bucket 400; }; };