initial progress: classify SSH events with some regexen and some code to follow a log file