Under Linux operating system you can use the faillog command to display faillog records or to set login failure limits. faillog command displays the contents of the failure log from /var/log/faillog database file. It also can be used for maintains failure counters and limits. If you run faillog command without arguments, it will display only list of user faillog records who have ever had a login failure.

Synopsis

faillog [options]

Options

The options which apply to the faillog command are:
-a, --all
Display faillog records for all users.
-h, --help
Display help message and exit.
-l, --lock-time SEC
Lock account to SEC seconds after failed login.
-m, --maximum MAX
Set maximum number of login failures after the account is disabled to MAX. Selecting MAX value of 0 has the effect of not placing a limit on the number of failed logins. The maximum failure count should always be 0 for root to prevent a denial of services attack against the system.
-r, --reset
Reset the counters of login failures or one record if used with the -u LOGIN option. Write access to /var/log/faillog is required for this option.
-t, --time DAYS
Display faillog records more recent than DAYS. The -t flag overrides the use of -u.
-u, --user LOGIN
Display faillog record or maintains failure counters and limits (if used with -l, -m or -r options) only for user with LOGIN.

Examples

To display all failed login attempt with following command:

# faillog -a

Sample outputs

Login       Failures Maximum Latest                   On

root            0        0   01/01/70 07:00:00 +0700
bin             0        0   01/01/70 07:00:00 +0700
daemon          0        0   01/01/70 07:00:00 +0700
adm             0        0   01/01/70 07:00:00 +0700
lp              0        0   01/01/70 07:00:00 +0700
sync            0        0   01/01/70 07:00:00 +0700
shutdown        0        0   01/01/70 07:00:00 +0700
halt            0        0   01/01/70 07:00:00 +0700
mail            0        0   01/01/70 07:00:00 +0700
news            0        0   01/01/70 07:00:00 +0700
uucp            0        0   01/01/70 07:00:00 +0700
operator        0        0   01/01/70 07:00:00 +0700

To display failed login attempt for user root with following command:

# faillog -u root

Sample outputs

Login       Failures Maximum Latest                   On

root            0        0   01/01/70 07:00:00 +0700

The post How To Display Failed Login Attempt ? appeared first on lifeLinux: Linux Tips, Hacks, Tutorials, Ebooks.