Under Linux operating system you can use the faillog command to display faillog records or to set login failure limits. faillog command displays the contents of the failure log from /var/log/faillog database file. It also can be used for maintains failure counters and limits. If you run faillog command without arguments, it will display only list of user faillog records who have ever had a login failure.
Synopsis
faillog [options]
Options
The options which apply to the faillog command are: -a, --all Display faillog records for all users. -h, --help Display help message and exit. -l, --lock-time SEC Lock account to SEC seconds after failed login. -m, --maximum MAX Set maximum number of login failures after the account is disabled to MAX. Selecting MAX value of 0 has the effect of not placing a limit on the number of failed logins. The maximum failure count should always be 0 for root to prevent a denial of services attack against the system. -r, --reset Reset the counters of login failures or one record if used with the -u LOGIN option. Write access to /var/log/faillog is required for this option. -t, --time DAYS Display faillog records more recent than DAYS. The -t flag overrides the use of -u. -u, --user LOGIN Display faillog record or maintains failure counters and limits (if used with -l, -m or -r options) only for user with LOGIN.
Examples
To display all failed login attempt with following command:
# faillog -a
Sample outputs
Login Failures Maximum Latest On root 0 0 01/01/70 07:00:00 +0700 bin 0 0 01/01/70 07:00:00 +0700 daemon 0 0 01/01/70 07:00:00 +0700 adm 0 0 01/01/70 07:00:00 +0700 lp 0 0 01/01/70 07:00:00 +0700 sync 0 0 01/01/70 07:00:00 +0700 shutdown 0 0 01/01/70 07:00:00 +0700 halt 0 0 01/01/70 07:00:00 +0700 mail 0 0 01/01/70 07:00:00 +0700 news 0 0 01/01/70 07:00:00 +0700 uucp 0 0 01/01/70 07:00:00 +0700 operator 0 0 01/01/70 07:00:00 +0700
To display failed login attempt for user root with following command:
# faillog -u root
Sample outputs
Login Failures Maximum Latest On root 0 0 01/01/70 07:00:00 +0700