• The answer I have back from MS is that this is not enabled for Linux. They recommend using a Server Audit and an audit specification for failed and successful logins (FAILED_LOGIN_GROUP and SUCCESSFUL_LOGIN_GROUP)