I have used logwatch, logcheck and similar but when there are hardware problems or network issues, even users with wrong passwords, the answer can usually be found in the logs so it makes a great diagnostic tool. We have a policy of contacting any of our network users as soon as they type in a password wrong. It is a great security benefit as well. It is also very simple to implement, just add -r to the syslog command to recieve messages or add *.* @other.log.host to syslog.conf to send elsewhere.