I put together a script a while back for this purpose. I wanted to be alerted whenever anyone logged into the router or when anyone failed to log in. This was my solution:
http://forum.mikrotik.com/t/is-it-possible-to-run-a-script-on-login/55422/1
The script can be easily modified to search for any text you would like. The example searches for logs that contain the text “logged in” or “login failure”.
:local currentBuf [ :toarray [ /log find message~"logged in" || message~"login failure" ] ] ;
If you only want to check for login failures, something like this:
:local currentBuf [ :toarray [ /log find message~"login failure" ] ] ;
See the script for the full code…