how to track webadmin login failures?

[Adam Katz]

I'm trying to tweak fail2ban <http://www.fail2ban.org/> to function with
Kolab.  Fail2ban monitors log files and temporarily blocks any IP with 5+
authentication failures in a ten minute period (blocked with iptables for
10 minutes).  This requires a regular expression to find such failures,
and I can't figure out how to do that with the kolab-webadmin interface.

I did find cyrus (sieve/imap) configs over at
https://trac.cyconet.org/debian/browser/configs/fail2ban
(they need some tweaking, but it was a good start).

Ideas?