On 2018-05-04, Kapfhammer, Stefan <sk...@skapf.de> wrote: > > You might want to parse /var/log/authlog and the logrotated authlog.[0-9].gz
This wheel has been invented several times, if someone wants to make their own they should study revisions to past designs as there have been some nasty problems fixed along the way. Rather than parsing authlog from disk, it's better to have syslogd pipe to a command instead.
