I used hash
instead of push(@failhost,$1); I use:
$failhost{$1}++;
similar:

$ls = keys %failhost;
if ($ls>0)
{
while (my ($ip, $count) = each(%failhost))

no its working

This will stop error messaging from filling up your var/mail/root

#!/usr/bin/perl -w
use strict;
use warnings;
my (@failhost);
my %currblocked;
my %addblocked;
my $action;
my $blockedhosts;

I was quite proud that I found out how to iptables -j DROP the addresses I watched attacking me in the asterisk console, but this script is of course what I should have googled for in the first place.

Thanks again
Arno

while () {
    chomp; my $line = $_;
    if ($line =~ /\' failed for \'(.*?)\' - No matching peer found/) {
      push(@failhost,$1);
    }
    if ($line =~ /\' failed for \'(.*?)\' - Wrong password/) {
      push(@failhost,$1);
    }
  }

For example, for what you want…

while () {
    chomp; my $line = $_;
    if ($line =~ /\' failed for \'(.*?)\' - No matching peer found/) {
      push(@failhost,$1);
    }
    if ($line =~ /\' failed for \'(.*?)\' - Wrong password/) {
      push(@failhost,$1);
    }
    if ($line =~ /\' failed for \'(.*?)\' - Device does not match ACL/) {
      push(@failhost,$1);
    }
  }

I have been receiving 10s if not 100s of registration attempts a second when the attack begins. Rather than decreasing the cron job frequency, I have added rate limiting which uses the state module:
http://pbxinaflash.com/forum/showthread.php?t=5018

Now, no more than a few failed attempts until your script kicks in the next cron job.