Auditbeat authentications log

Hello !

I'm trying to receive the authentication faillure and success from my devices but i'm having few complications..

From my windows devices, it's ok, i'm able to receive log out / in / failled , with winlogbeat
but from linux i'm lost. I'm trying with auditbeat and i can have 'authentication success' from event.type, but i can't find authentication failed...
when i check the var/log/btmp, it's empty, i tried to faille my login session few times, but i have still nothing.

Can someone help me ?
thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.