@8p8c yeah I came to the same conclusion. we have the ability to just pick up

auth.log

file as it changes on the host. I could parse it from there