The default format for an Apache access_log contains the userid of the person loggin into an area where authentication is required.

You could setup your own customized access_log using the CustomLog, AccessLog and LogFormat directives which would only list userid and access code so you can log successful and failed logins. Check out the Apache website for more information about this.

If you decide to do this, then you might find the module File::Tail useful for reading from your continously updated access_log files.

A note to remember about this is that it will list every page the user has requested in your access_log. You will need to keep this in mind when extracting usernames from your logs. You will only need the first instance of each login which can become quite tricky if the same person logs in twice in a row.

- wil