# mariadb Refused logins from MariaDB's or MySQL's error log (`/var/log/mysql/error.log`). Category `mysql`. On most hosting machines the database listens on the loopback only, and this parser will never match a thing — deliberately, because it requires the host part of `'user'@'host'` to look like an address, and `'x'@'localhost'` is a local service with the wrong password rather than an attacker. That is worth keeping rather than deleting: `shield stats` prints every rule's hit count, so a rule reading `0 hits` is a visible statement that this door is shut. The day someone opens 3306 to the world, it starts working with no change.