/system logging action add memory-lines=1000 memory-stop-on-full=no name=failedauth target=memory
/system logging add action=failedauth disabled=no prefix="" topics=critical,system,error

{
  :local logBuffer "failedauth";
  :local lines;
  /system logging action {
     :set lines [get ($logBuffer) memory-lines];
     set ($logBuffer) memory-lines 1;
     set ($logBuffer) memory-lines $lines;
  };
  :put "$lines"
}