Every day I run a search that finds any users who have had at least 5 failed login attempts
source="secure" sshd "pam_ldap: error trying to bind as user"|top uid limit=500 | search count >= 5
This works fine but once a month I want to compile a report of how many users had 5 or more failed login attempts in a 24 hour period. So I need to create a search that covers 30 days but only show me users that had at least 5 failed logins in a 24 hour period at some point during the 30 days and they could of also of had 5 failed logins at 2 different days during the 30 day period. Hope that makes sense!
Does anyone know how to do this?
Thanks,
