Hi,
tonight I find the following entry in my logs, but no e-mail, notification on failed login is enabled. I know who tried to login.
Ian M
2010:03:22-20:14:28 fw1-on-house su: FAILED SU (to root) loginuser on /dev/pts/0
2010:03:22-20:14:36 fw1-on-house su: (to root) loginuser on /dev/pts/0