Allows for configuring either general or specific warning or critical
levels, or any combination of that.
This should be backwards compatible, since it doesn't change a thing to
the output, unless specific variables are specified.
In fact for journald mode internally it really is type ABSOLUTE, because
we use journald cursor to get only new logs on each collect. It results
in the same value as with a plain log file and type DERIVE: it's the
rate of events.
type=DERIVE is best for servers with lots of ssh traffic.
Now shows the number of events per time unit, instead of a counter
always increasing until logrotate.
To use journald, set env.logfile to special value 'journald': It will
read the sshd logs from journalctl _COMM=sshd.
To configure the source of journald, set env.journalctlarg:
Example: "env.journalctlarg --unit=sshd.service"
