Monit Config for Alerting SSH Logins

# Monit config to alert on ssh logins
# File: /etc/monit/conf.d/ssh_login

# watch /var/log/auth.log for ssh logins and email alert
# on successful and failed logins

check file ssh_accepted_logins with path /var/log/auth.log
        if match "Accepted" then alert

check file ssh_failed_logins with path /var/log/auth.log
        if match "Failed" then alert