SSH logging

Imam en problem...postavljal sem en RHEL4 server (osebno sem drugače raje na slacku ;)) pa ful strange logira ssh connectione v log. Evo en zaporedje (najprej napačen user, potem pravilen user in pass in nato napačen pass):

Oct 12 19:00:37 server sshd[31699]: Invalid user blabla from ::ffff:84.255.xx.xx
Oct 12 17:00:37 server sshd[31702]: input_userauth_request: invalid user blabla
Oct 12 17:00:37 server sshd[31702]: Failed none for invalid user blabla from ::ffff:84.255.xx.xx port 3355 ssh2
Oct 12 19:00:41 server sshd[31699]: Failed password for invalid user blabla from ::ffff:84.255.xx.xx port 3355
ssh2
Oct 12 17:00:41 server sshd[31702]: Failed password for invalid user blabla from ::ffff:84.255.xx.xx port 3355
ssh2
Oct 12 17:00:41 server sshd[31702]: Connection closed by ::ffff:84.255.xx.xx
Oct 12 17:01:32 server sshd[31715]: Accepted password for sasos from ::ffff:84.255.xx.xx port 4647 ssh2
Oct 12 19:01:32 server sshd[31712]: Accepted password for sasos from ::ffff:84.255.xx.xx port 4647 ssh2
Oct 12 19:13:17 server sshd[32159]: Failed password for sasos from ::ffff:84.255.xx.xx port 3358 ssh2
Oct 12 17:13:17 server sshd[32160]: Failed password for sasos from ::ffff:84.255.xx.xx port 3358 ssh2
Oct 12 17:13:18 server sshd[32160]: Connection closed by ::ffff:84.255.xx.xx

V logih je vse podvojeno, in to enkrat z napačno uro, tako da se na koncu sploh ne znajdeš. Gor bi rad dal blockhosts in stvar zaradi podvojenih vnosov (in različnih pidov!) vse napačne logine šteje 2x.
Imel sem sicer idejo da bi blockhosts obesil na pam loge, recimo

Oct 11 01:08:45 server sshd(pam_unix)[9429]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=pppf1628.tokyo-ip.dti.ne.jp

da bi ujel tele kekce ki bruteforcajo ampak rhost= rabim imet neresolvano, samo IP...

kaj je za nardit?