This example logs the first 10 seconds or the tagged_packet_limit (whichever comes first) of any telnet session.
alert tcp any any -> any 23 (flags:S,CE; tag:session,10,seconds;)