System log filter - email alerts

[roma]

I would like to receive email alerts on certain system events, such as when there is a successful login and unsuccessful login attempt from GUI and CLI. (Among other events).

The filter for the stem log is looking for certain "strings" or "attributes" Andi have no idea where to find them. Any ideas?

Thanks.

[PavelK · Accepted solution]

Thank you for the post @roma

this string will capture all successful and failed login attempts from GUI/CLI: ( description contains 'failed authentication' ) or ( description contains 'logged in' ) or ( description contains 'logged out' ) 

Kind Regards

Pavel