del-SLE wrote:
If a user, me, logs into root and fails an entry is made in /var/log/ messages. Why isn't /var/log/faillog also recording these? I purposely logged into root with a dodgy password and, as root,
# faillog -u root displays
Username Failures Maximum Latest root 0 0
Or am I missing the concept of faillog and all it should do is pass the login failure to messages?
Hard to say what your problem is... it's working here on SuSE 8.2 s4:/home/jimbo # faillog -a Username Failures Maximum Latest root 1 0 Fri Oct 3 07:49:54 -0700 2003 on tty6 jimbo 2 0 Fri Oct 3 07:51:44 -0700 2003 on tty4 s4:/home/jimbo # Are you actually getting anything written to /var/log/faillog? s4:/home/jimbo # strings /var/log/faillog tty6 tty4 s4:/home/jimbo # Jim