Build a Python command-line tool that summarizes SSH failures from auth logs

#!/usr/bin/env python3
"""Summarize failed SSH logins from auth logs."""
import argparse, collections, csv, gzip, re, sys

PAT = re.compile(r'^(?P<ts>\w{3}\s+\d+ [\d:]+).*sshd\[\d+\]: (?:Failed password for (?:invalid user )?|Invalid user )(?P<user>\S+) from (?P<ip>[\d.]+)')

def lines(path):
    opener = gzip.open if path.endswith('.gz') else open
    with opener(path, 'rt', errors='replace') as f:
        yield from f

def main():
    p = argparse.ArgumentParser(description=__doc__)
    p.add_argument('logs', nargs='+')
    p.add_argument('--top', type=int, default=10)
    p.add_argument('--csv')
    a = p.parse_args()
    by_ip, by_user, first = collections.Counter(), collections.Counter(), {}
    for path in a.logs:
        for line in lines(path):
            m = PAT.search(line)
            if m:
                by_ip[m['ip']] += 1; by_user[m['user']] += 1
                first.setdefault(m['ip'], m['ts'])
    print(f'{"ip":16} {"fails":>6}  first seen')
    for ip, n in by_ip.most_common(a.top):
        print(f'{ip:16} {n:6}  {first[ip]}')
    print('\ntop usernames:', ', '.join(f'{u}({n})' for u, n in by_user.most_common(a.top)))
    if a.csv:
        with open(a.csv, 'w', newline='') as f:
            w = csv.writer(f); w.writerow(['ip', 'fails', 'first_seen'])
            w.writerows((ip, n, first[ip]) for ip, n in by_ip.most_common())
    return 0

if __name__ == '__main__':
    sys.exit(main())

sudo python3 sshfails.py /var/log/auth.log* --top 5 --csv fails.csv
sudo zgrep -c 'Failed password' /var/log/auth.log*