# Show failed GDM logins on Login Dasboard

**URL:** <https://discuss.elastic.co/t/show-failed-gdm-logins-on-login-dasboard/317039>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [October 19, 2022, 5:29pm UTC](https://discuss.elastic.co/t/show-failed-gdm-logins-on-login-dasboard/317039 "2022-10-19T17:29:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dredshaw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dredshaw/32/112037_2.png) [@dredshaw](https://discuss.elastic.co/u/dredshaw)\
**Post date:** [October 19, 2022, 5:29pm UTC](https://discuss.elastic.co/t/show-failed-gdm-logins-on-login-dasboard/317039/1 "2022-10-19T17:29:26Z")

</div>

I am using Auditbeat on a standalone system in a closed area with no internet access. I set up Elasticsearch, Kibana, and Auditbeat to audit the system. This was easy enough. I Would like to get the Login Dashboard to show failed GDM logins. Does anyone have a suggestion accomplish this? The dashboard will only show failed SSH logins.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 19, 2022, 9:48pm UTC](https://discuss.elastic.co/t/show-failed-gdm-logins-on-login-dasboard/317039/2 "2022-10-19T21:48:59Z")

</div>

What's GDM?

---

<div class="post-metadata">

**Author:** ![dredshaw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dredshaw/32/112037_2.png) [@dredshaw](https://discuss.elastic.co/u/dredshaw)\
**Post date:** [October 20, 2022, 3:43pm UTC](https://discuss.elastic.co/t/show-failed-gdm-logins-on-login-dasboard/317039/3 "2022-10-20T15:43:58Z")

</div>

GDM is the GNOME Display Manager. It provides the login environment for logging into the system. The module for Auditbeat gets the login information for logins from /var/log/wtmp (good logins, logouts, and system boot information) and /var/log/btmp (bad logins). The login success table reports all information as expected. The login failures table will only show bad logins for ssh.

After a little digging I think that the auditbeat module works as intended. When I enter the last command, the output is the information that goes in the login success table. When enter the lastb commnad, I only get failed SSH logins. /var/log/btmp only records bad ssh logins. Since the module only looks in /var/log/btmp (not auth.log or the auditd log). The tables in the dashboard are working as expected.

Unless their is a way to send bad GDM logins to /var/log/btmp (maybe with PAM Module configuration?) I might need another solution. I would need a dashboard or table for authentications. I can search for and find everything I want with discover under analytics in Kibana. Is there a dashboard template available for authentications? I'm not sure the best way to go about creating a table or dashboard for authentications. Any suggestions would be helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2022, 5:44pm UTC](https://discuss.elastic.co/t/show-failed-gdm-logins-on-login-dasboard/317039/4 "2022-11-17T17:44:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.