diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f17d56..967fe49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+- Add promtail configuration for `auth.log` [#27](https://github.com/coopdevs/monitoring-role/issues/27)
+
 ## [v0.5.0]  - 2023-05-18
 ## Feat
 - Add new exporter for users [#26](https://github.com/coopdevs/monitoring-role/pull/26/)
diff --git a/README.md b/README.md
index dbc24ef..c27664e 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,7 @@ Uses docker to install Prometheus and Loki exporters:
 This role supports some applications with their default logging format:
 * [Odoo12](https://github.com/coopdevs/odoo-role)
 * [Coopdevs backups](https://github.com/coopdevs/backups-role/)
+* [`auth.log`](templates/promtail-config-apps/auth.j2)
 
 Besides, it supports a [custom exporter](https://github.com/stfsy/prometheus-what-active-users-exporter) that exposes the active users in the system.
 
diff --git a/defaults/main.yml b/defaults/main.yml
index 89d27cf..895fbd2 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -23,6 +23,7 @@ monitoring_promtail_image_version: latest
 monitoring_promtail_modules_enabled:
   - "backups"
   - "odoo"
+  - "auth"
 monitoring_promtail_modules_available:
   backups:
     # Use backups-role var if available.
@@ -34,6 +35,10 @@ monitoring_promtail_modules_available:
     log_path: "{{ odoo_role_odoo_log_path | default('/var/log/odoo') }}/odoo.log"
     template: "odoo-role.j2"
     log_path_folder: "{{ odoo_role_odoo_log_path | default('/var/log/odoo') }}"
+  auth:
+    log_path: "/var/log/auth.log"
+    template: "auth.j2"
+    log_path_folder: "/var/log"
 
 monitoring_promtail_config_dir: "/etc/promtail"
 monitoring_promtail_config_filename: "config.yml"
diff --git a/templates/promtail-config-apps/auth.j2 b/templates/promtail-config-apps/auth.j2
new file mode 100644
index 0000000..1185e0b
--- /dev/null
+++ b/templates/promtail-config-apps/auth.j2
@@ -0,0 +1,20 @@
+  - job_name: auth
+    pipeline_stages:
+    - regex:
+        expression: '^(?P<timestamp>\S+ \S+ \S+) (?P<host>\S+) (?P<program>[^\[]+)(\[(?P<processid>\d+)\])?: (?P<message>.*)'
+
+    - timestamp:
+        source: timestamp
+        format: 'Jan 2 15:04:05'
+        location: 'Europe/Madrid'
+    - labels:
+        program:
+    - output:
+        source: message
+    static_configs:
+      - targets:
+        - localhost
+        labels:
+        job: auth
+        instance: {{ inventory_hostname }}
+        __path__: {{ monitoring_promtail_modules_available["auth"]["log_path"] }}