Auth collector from either systemd logger or fallback /var/log/secure (old Amazon V1). Use this as primary last login source in check last login script
