Hi, I'm using SUSE 9.2 and need to track user logins - logouts, root login - logout, and bad user logins. The user logins-logouts and root login-logouts are being written to /var/log/messages (pam-unix2). However, the bad login attempts are not being recorded. I've activated the "Record failed login attempts" in Yast with no success. I've also tried the faillog utility, again with no success. I've tried defining /var/log/btmp and using lastb to read that file, again with no success. Unless I'm looking in the wrong place, it seems to me that bad login attempts are not being recorded by Suse 9.2. I'd like to know where bad logins are supposed to be recorded in Suse 9.2 and what needs to be set to record bad logins (I get the feeling that a parameter in some configuration file is not set properly). I assume that people on this list monitor bad logins. How is it being done? Thanks in advance. Bill Arcieri