The security notifications feature will automatically send emails when a specified amount of login failures have occurred on the Totara LMS site.
To access these settings go to the Administration block and go to Site Administration > Security > Notifications.
The notifications page contains the following options:
Display login failures: When set, a link stating the number of failed logins will appear next to the allowed user's login information. This is typically found either at the top or bottom of the page - depending on theme design. Users can follow this link to access the login error page.
Email login failures to: Send login failure notification messages to these selected users. This notification contains information on the username that was used, whether it belongs to a real user, what time the failure occurred and from which IP address the login was attempted. This requires an internal logstore (e.g. Standard Logstore) and Cron to be enabled.
This email notification is sent by the 'Send failed login notifications (\core\task\send_failed_login_notifications_task)' and the frequency of this message may be controlled through the Scheduled tasks interface.
Threshold for email notifications: If login failures are being tracked, specify how many failed login attempts by one user or one IP address can be recorded before an email is generated to the user(s) selected above.
Click Save changes to save your settings.