Python read ip address and if over 10 attempts save to file called failed.py
myFile = open('auth','r')

ips = {}

for line in myFile:
    parts = line.split(' ')
    if parts[3] == 'authentication failure':
        if parts[3] in ips:
            ips[parts[0]] += 1
        else:
            ips[parts[0]] = 0

with open('failed.py','w') as myFile:
    for ip in [k for k, v in ips.iteritems() if v >=10]:
        myFile.write(ip)

Jan 10 09:32:07 j4-be03 sshd[3876]: pam_unix(sshd:auth): authentication failure;    logname= uid=0 euid=0 tty=ssh ruser= rhost=218.241.173.35  user=root
Jan 10 09:32:09 j4-be03 sshd[3876]: Failed password for root from 218.241.173.35 port 47084 ssh2

from collections import defaultdict
ips = defaultdict(int)
with open('auth','r') as f:
  for line in f:
    if "authentication failure" in line:
      # split on multiple whitespace characters and use second-last element
      ip = line.split()[-2].split('=')[1]
      ips[ip] += 1

with open('failed.txt','w') as f:
  for ip in [k for k, v in ips.iteritems() if v >=10]:
    f.write(ip)