I thought about /var/log/secure and while I'll definitely try it as an alternative, it has a different format than the one from the snippet code which is from /var/log/wtmp. One obstacle is that it's a binary file. Is possible to have filebeat read from that? And is it possible to have the data shipped into the auditbeat dashboard?