So I am trying to build an alert for user logon failures to my cisco devices. I have a filter that allows me to monitor real time using LEM and it provides most of the information I would like however I would like email notification whenever someone fails logon to my routers and switches. I created a custom email template that has what I believe I want. I have also created the rule that sends the email alerts. The rule is working fine, it sends me the email when I intentionally fail logon to my device. However the email itself is not including the information I want. Can anyone tell me what I am doing wrong?
I have included screenshots in the attachments.
