diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index 27ee39b..a359a8b 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -4276,13 +4276,21 @@ function authenticate_user_login($username, $password, $ignorelockout=false, &$f
         // Use manual if auth not set.
         $auth = empty($user->auth) ? 'manual' : $user->auth;
         if (!empty($user->suspended)) {
-            add_to_log(SITEID, 'login', 'error', 'index.php', $username);
+            $suspendedevent = core\event\user_login_error::create(
+                array('relateduserid'=>$user->id,
+                      'other'=>array('username' => $username,
+                                     'reason' => 'Suspended login')));
+            $suspendedevent->trigger();
             error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Suspended Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
             $failurereason = AUTH_LOGIN_SUSPENDED;
             return false;
         }
         if ($auth=='nologin' or !is_enabled_auth($auth)) {
-            add_to_log(SITEID, 'login', 'error', 'index.php', $username);
+            $disabledevent = core\event\user_login_error::create(
+                array('relateduserid'=>$user->id,
+                      'other'=>array('username' => $username,
+                                     'reason' => 'Disabled login')));
+            $disabledevent->trigger();
             error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Disabled Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
             // Legacy way to suspend user.
             $failurereason = AUTH_LOGIN_SUSPENDED;
@@ -4300,7 +4308,10 @@ function authenticate_user_login($username, $password, $ignorelockout=false, &$f
 
         // Do not try to authenticate non-existent accounts when user creation is not disabled.
         if (!empty($CFG->authpreventaccountcreation)) {
-            add_to_log(SITEID, 'login', 'error', 'index.php', $username);
+            $nouserevent = core\event\user_login_error::create(
+                array('other'=>array('username' => $username,
+                                     'reason' => 'Unknown user and cannot create new accounts')));
+            $nouserevent->trigger();
             error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Unknown user, can not create new accounts:  $username  ".$_SERVER['HTTP_USER_AGENT']);
             $failurereason = AUTH_LOGIN_NOUSER;
             return false;
@@ -4318,7 +4329,11 @@ function authenticate_user_login($username, $password, $ignorelockout=false, &$f
     } else if ($user->id) {
         // Verify login lockout after other ways that may prevent user login.
         if (login_is_lockedout($user)) {
-            add_to_log(SITEID, 'login', 'error', 'index.php', $username);
+            $lockoutevent = core\event\user_login_error::create(
+                array('relateduserid'=>$user->id,
+                      'other'=>array('username' => $username,
+                                     'reason' => 'Login lockout')));
+            $lockoutevent->trigger();
             error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Login lockout:  $username  ".$_SERVER['HTTP_USER_AGENT']);
             $failurereason = AUTH_LOGIN_LOCKOUT;
             return false;
@@ -4371,7 +4386,11 @@ function authenticate_user_login($username, $password, $ignorelockout=false, &$f
 
         if (!empty($user->suspended)) {
             // Just in case some auth plugin suspended account.
-            add_to_log(SITEID, 'login', 'error', 'index.php', $username);
+            $suspendedevent = core\event\user_login_error::create(
+                array('relateduserid'=>$user->id,
+                      'other'=>array('username' => $username,
+                                     'reason' => 'Suspended Login')));
+            $suspendedevent->trigger();
             error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Suspended Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
             $failurereason = AUTH_LOGIN_SUSPENDED;
             return false;
@@ -4383,7 +4402,13 @@ function authenticate_user_login($username, $password, $ignorelockout=false, &$f
     }
 
     // Failed if all the plugins have failed.
-    add_to_log(SITEID, 'login', 'error', 'index.php', $username);
+    $eventdata = array('other'=>array('username' => $username,
+                                      'reason' => 'Suspended Login'));
+    if ($user->id) {
+        $eventdata['relateduserid'] = $user->id;
+    }
+    $failloginevent = core\event\user_login_error::create($eventdata);
+    $failloginevent->trigger();
     if (debugging('', DEBUG_ALL)) {
         error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Failed Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
     }