Failed logins are logged to syslog with the login id set to UNKNOWN or UNSET
Failed login attempts are logged to syslog with the user id or login id set to UNKNOWN_USER or UNSET.
Anybody know if this is configurable. I would rather it just pass the actual id that the user used. Doesn't matter if it exist or not, just want to know if someone is guessing at user names and what those user names are.
Thanks in advance