Watch snort fast log and blacklist source ip adresses whose gid is 115.