Associate an action with failed login on ESA

[mailsecurity]

hi,

do we have a way to associate failed logins with an event? Mail Notification for example.

The Authentication LOG shows Failed for Username and IP. I can't find any way in GUI and CLI to associate an action with this.

How do you handle it?

THX!!

[shane.dollery]

This section in the User Guide has some details: Configuring Restrictive User Account and Passphrase Settings

[mailsecurity]

THX good hint for me,

if the valid number of login attempts is exceeded (Local User Account & Passphrase Settings) then the account will be locked and the Alert Recipients will receive an info about it.
The account must be unlocked via another account (ADMIN). At least something.

Another solution is to use SYSLOG to evaluate the "LOGIN" LOG for Failed via other mechanisms and then generate an action.