> Is someone has already successfully make the login_success (or
> login_failure) event work?
> The event always returns : user= <none>, password=<timeout>.
(1) What version of Bro are you running?
(2) Do you really have plaintext telnet/rlogin traffic? (That's what the
analyzer focuses on. It's very old.)
Vern