Looks at the auth log, looks for failed atempts and reports them.

report_login.sh

#!/bin/bash

linecount=$(cat /var/log/auth.log | grep -i FAILED | wc -l)
cat /var/log/auth.log | grep -i FAILED > log.aux

x=1
#invalid users
rm log.aux2
while [ $x -le $linecount ]; do
	flag=0
	line=$(tail -n $x ~/log.aux | grep -i FAILED | head -n 1 | cut -d ] -f 2)
	if [ $x == 1 ]; then
		finishdate=$(tail -n $x ~/log.aux | grep -i FAILED | head -n 1 )
		finishdate=${finishdate/INV00049/;}
		finishdate=$(echo $finishdate | cut -d \; -f 1)
	fi

	if [[ $line == *"message repeated 2 times"* ]]
	then
  		flag=1;
	fi

	line=${line/failed for user (/; }
	line=${line/password for invalid user/; }
	line=${line/invalid user/; }
	line=${line/su for/; }
	line=${line/Failed password for /; }
	line=${line/)/' '}
	
	line=$(echo $line | cut -d \; -f 2 | cut -d ' ' -f 2 )
	echo $line >> log.aux2
	if [ $flag -eq 1 ]; then
		echo $line >> log.aux2
	fi
	x=$(( $x + 1 )) 

done
rm mail.txt
cat log.aux2 | sort | uniq -c >> mail.txt
echo last failed login on: $finishdate >> mail.txt