<div dir="ltr"><a href="http://www.cyberciti.biz/faq/faillog-in-linux-command/">http://www.cyberciti.biz/faq/faillog-in-linux-command/</a><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 22, 2014 at 10:55 AM, Paul Cartwright <span dir="ltr"><<a href="mailto:pbcartwright@gmail.com" target="_blank">pbcartwright@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"># file /var/log/faillog<br>
/var/log/faillog: data<br>
<br>
# strings /var/log/faillog<br>
pauls-server:/home/pbc #<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
> Paul, what does "file /var/log/faillog" say? How about "strings<br>
> /var/log/faillog"?<br>
><br>
> Of course, it could have been a file that's held open but already removed.<br>
><br>
><br>
><br>
> On Mon, Sep 22, 2014 at 10:13 AM, Paul Cartwright<br>
> <<a href="mailto:pbcartwright@gmail.com">pbcartwright@gmail.com</a>> wrote:<br>
>> weird... I have a faillog, but it looks like a data file. when I try<br>
>> more, it shows blanks..<br>
>><br>
>> ls -l /var/log/faillog<br>
>> -rw------- 1 root root 32000 Sep 11 14:57 /var/log/faillog<br>
>> pauls-server:/home/pbc # tail /var/log/faillog<br>
>> pauls-server:/home/pbc #<br>
>><br>
>><br>
>> tail shows nothing either..<br>
>><br>
>>> Never heard of a "faillog". There is secure and audit logs. /var/log/secure<br>
>>> handles login attempts. If auditd is running, /var/log/audit/* handles all<br>
>>> manner of access internal to the system (I.e. not web server access).<br>
>>> Perhaps those are what was inferred.<br>
>>> On Sep 22, 2014 9:43 AM, "Raj Wurttemberg" <<a href="mailto:rajaw@c64.us">rajaw@c64.us</a>> wrote:<br>
>>><br>
>>>> My Google-Fu must be running low this this morning...<br>
>>>><br>
>>>> What creates /var/log/faillog ? I have a RHCE 6.5 server and a security<br>
>>>> auditor said that we should have a /var/log/faillog file. I have the<br>
>>>> "pam_tally2" module loaded in the auth file "system-auth-ac" . The<br>
>>>> pam_tally2 command does appear to give proper results as well.<br>
>>>><br>
>>>> Kind regards,<br>
>>>> Raj Wurttemberg<br>
>>>> <a href="mailto:rajaw@c64.us">rajaw@c64.us</a><br>
>>>><br>
>>>><br>
>>>> _______________________________________________<br>
>>>> Ale mailing list<br>
>>>> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>>>> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>>>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>>>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>>>><br>
>>> -------------- next part --------------<br>
>>> An HTML attachment was scrubbed...<br>
>>> URL: <<a href="http://mail.ale.org/pipermail/ale/attachments/20140922/cb52c48d/attachment.html" target="_blank">http://mail.ale.org/pipermail/ale/attachments/20140922/cb52c48d/attachment.html</a>><br>
>>> _______________________________________________<br>
>>> Ale mailing list<br>
>>> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>>> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
>>><br>
>>><br>
>><br>
>> --<br>
>> Paul Cartwright<br>
>> Registered Linux User #367800 and new counter #561587<br>
>><br>
>> _______________________________________________<br>
>> Ale mailing list<br>
>> <a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
>> <a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
>> See JOBS, ANNOUNCE and SCHOOLS lists at<br>
>> <a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
><br>
><br>
<br>
<br>
--<br>
Paul Cartwright<br>
Registered Linux User #367800 and new counter #561587<br>
<br>
_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><b><i>- Shawn Taaj</i></b><br>
</div>