egrep -i " su|failed|failure|refused|not allowed|illegal
port|blocked|denied|passwd|portscan|queso"  /var/log/messages
=============================================
%s/^\(.*\) \(.*\)$/\2, \1/      swap words on line