#!/bin/sh

# gather journal information in time frame
export CRUFT=$(journalctl --since="$(date -d -1hours +\%F\ \%H):00:00" --until="$(date +\%F\ \%H):00:00" | grep -iE "Failed (pass|log)")

#email settings
export EMAILFROM="From: Security Alert <yourmail@email.domain>"
export EMAILSUBJECT="Subject: Failed login Summaries from $(date -d -1hours +\%H):00 to $(date +\%H):00"
export EMAILALERTTO="your@email.domain"

if [ "x$CRUFT" != "x" ]; then
        echo -e "$EMAILFROM\n$EMAILSUBJECT\n\nFailed logins:\n$CRUFT" | ssmtp "$EMAILALERTTO"
fi