I get the regular connect and disconnect messages ie the 7220xx messages but I tested several bad password attempts and they do not get logged. is there a way to log this?
Would be interested in creating an EEM that would alert on a significant amount of failed logons for then taking action such as shunning the offending bruteforce IP etc.
