change output to consider SSH logins and failed logins