Faillog in Linux: Display Records of Login Failure

I‘m running RHEL on HP server. This server allows to login to reset of the LAN from the Internet. How do I find out failed login records under Linux operating systems?

You need to use the faillog command to see the all failed login attempts. Linux records failed login into a special database at /var/log/faillog. To see contents of the failure log database at /var/log/faillog use faillog command. The same command can be used for

1. Set the failure counters.
2. Set or configure the limits.
3. Display failed login information.

More About /var/log/faillog File

The /var/log/faillog maintains a count of login failures and the limits for each account. The file is binary format with the following the structure of the file:

           struct    faillog {
                short   fail_cnt;
                short   fail_max;
                char    fail_line[12];
                time_t  fail_time;
                long    fail_locktime;
           };

You cannot view the structure using the cat command:
# cat /var/log/faillog
So you need to use the faillog command to display this binary file records.

faillog Command Examples