<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On May 13, 2020, at 8:55 AM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 5/13/20, 9:49 AM, "users on behalf of Ignacio Amoeiro Bosch" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:ignacio.amoeiro@extern.ibsalut.es" class="">ignacio.amoeiro@extern.ibsalut.es</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">Is possible to audit failed login authentications in audit-event logger?<br class=""></blockquote><br class="">No. That's impossible in general because most of them end up back on the login page waiting for another attempt. Auditing is at the request/response level of the overall profile attempt. Failed logins are a diagnostic logging use case. Failed authentication overall in the cases that a flow actually terminates in some way are audited with various event signals and/or SAML status results.<br class=""><br class="">Failed logins are also tracked numerically with metrics via counters.<br class=""><br class="">-- Scott<br class=""><br class=""></div></div></blockquote></div><div class=""><br class=""></div>Where we had a need to just send the process log "login succeeded/failed" messages to a syslog appender, we added the following to pull those messages (obviously dependent on the content of tha message, not sure if it changes in 4.x) from the process log. Of course, if you a flog file aggregation service, you can just have any such filtering logic there. <br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;"><br class=""></div><div style="text-align: start; text-indent: 0px;"><div> <!-- Only send authentication messages for password and Duo --></div><div> <filter class="ch.qos.logback.core.filter.EvaluatorFilter"></div><div> <evaluator></div><div> <matcher></div><div> <Name>Login</Name></div><div> <regex>Login by</regex></div><div> </matcher></div><div> <matcher></div><div> <Name>Duo</Name></div><div> <regex>Duo authentication</regex></div><div> </matcher></div><div> <expression>Login.matches(formattedMessage) || Duo.matches(formattedMessage)</expression></div><div> </evaluator></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><OnMismatch>DENY</OnMismatch></div><div> <OnMatch>ALLOW</OnMatch></div><div> </filter></div><div><br class=""></div><div>--</div>Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>