checkip
checkip(str, "password login", "root or admin");
checkip(str + 5, "password login", "an invalid user");
checkip(str + 5, "login", "an invalid user");
checkip(str + 25, "preauth", "an invalid user");
checkip(str + 5, "login", "many attempts");