SSH logins monitoring

[belgiumrom]

Hi guys, my first post here...
I looked around but couldn't find what I want...
I run a zabbix server v2.2.2 installed on Red Hat Enterprise Linux Server release 6.5 (Santiago). I have around 1400 hosts with 53000 items. Out of these hosts, around 400 are Linux (RH5 and RH6 all x64). All these linux hosts are running agent version 2.2.6.
I want to monitor the ssh logins in each server but I have no clue how can I implement this in zabbix or if it's even possible....
I want to use the command last -w and have some output of some sort, either list or graph, or grep the /var/log/secure for "Accepted publickey for" & "Rejected publickey for" and eventually, when the grep finds Rejected, to trigger me a message...

Thanks for all your input....

[belgiumrom]

I actually dealt with it myself...

Hello guys, after some googling and scripting I came with a 95% solution.
First, I allowed zabbix user to cat /var/log/secure.
Second, I made use of the user parameters in zabbix to translate somehow the number of failed ssh login attempts...
In /etc/zabbix/zabbix_agentd.d, I created a file root_login.conf with the following content:
UserParameter=root.ssh.login[*],sudo /bin/cat /var/log/secure|grep "Failed password"|wc -l
After this I created a template called "Template_SSH" with an application called "Failed SSH Connections", an item called "Number of failed ssh logins" (type=zabbix agent active, key=root.ssh.login[0], type=numeric unsigned, data type=decimal. A trigger to the above item is set and called "There are failed ssh login attempts on server {HOSTNAME} with the expression {Template_SSH:root.ssh.login[0].last(0)}>0. I also created a graph that displays the number of failed ssh logins (add the above created item for the graph).
The setup works fine but the fired triggers will display on the console until the /var/log/secure is rotated...I need to find a solution to overcome this...
Any ideas are welcome.