mail on successfully login to gui

I'm using ossec for those kinds of things.

example email warning:

Code:
OSSEC HIDS Notification. 
2012 Dec 20 11:22:58  

Received From: (PVE-1) 10.16.1.1->/var/log/syslog 
Rule: 800022 fired (level 5) -> "pve success login" 

Portion of the log(s):  Dec 20 11:22:58 proxmox pvedaemon[445357]: <root@pam> successful auth for user 'root@pam'    

--END OF NOTIFICATION
 
Many Thanks for hint! It seems to be a good idea!
I've found great topic about OSSEC HIDS so, it should be easy to install and configure!!

I've also see Swatch to do action when specific line are found (with perl regex) in log file!
What you think about that?