Interesting topic.
The dump query should look something like this:
select created, ip_address, title from ost_syslog where log_type='Warning' and title like '%CSRF%' and created >= now() - INTERVAL 1 HOUR;
The warning field is a short description. The log field is the long description. They both might be language customized, so you must tune the conditions to your local language.
In my case, the apache is behind my cloud vendor middleware, so this query is useless (the client IP is always the same). The filtering can be done in the middleware anyway. There is a setting inside ost-config.php in order to take the HTTP_X_FORWARDED_FOR in account to workaround this, but I haven't done my homework here.
Anyhow, if you are using apache and Ubuntu, going for a geoip apache module should be a more powerful approach.
