So, it likely depends on PAM config (or other auth mechanism) and what is being sent to audit — but osquery should provide the ability to tell the difference between a successful login and a failed one. I’ve only tried this in specific use cases (monitoring for remote logins), not local auth failures. (if not obvious, this is from the user_events table).