check login.hist

#!/usr/bin/perl

$maxattempts = 5;

$a=`find /usr/local/directadmin/data/users -type f -name login.hist`;
@login = split(/\n/, $a);
foreach(@login) {
        ($user) = /.*\/(.*)\/login.hist$/;
        open(HIST, $_);
        while($line=<HIST>) {
                chomp($line);
                ($attempts, $on, $from) = $line =~ /attempts=(\d+)&lastaccess=(.*?)&lasthostaccess=(.*)$/;
                if ($attempts > $maxattempts) {
                        $a=localtime(time()-86400);
                        $a=substr($a, 4, 3) . " " . int(substr($a, 8, 2));
                        if (substr($on, 0, length($a)) eq $a) {
                                print "WARNING: $user: $attempts on $on from $from\n";
                        }
                }
        }
        close(HIST);
}