:msg, contains, "SYN_ATTEMPT" /var/log/syn_attempts.log