Search Results

Regarding the "Failed none", I think you should turn to the sshd vendor i.e. Oracle, to get a patch/update for sshd.
Furthermore, the correct log level for sshd is auth.info (little more verbose...

Can you ask auditing to look for a different file name?

Assume they are looking for: auth.log create -> auth.log1

Simpleminded exmple:
tail -f auth.log | sed 's/Failed none/Login okay/' >>...