<p dir="ltr">Never heard of a "faillog". There is secure and audit logs. /var/log/secure handles login attempts. If auditd is running, /var/log/audit/* handles all manner of access internal to the system (I.e. not web server access).<br>
Perhaps those are what was inferred.</p>
<div class="gmail_quote">On Sep 22, 2014 9:43 AM, "Raj Wurttemberg" <<a href="mailto:rajaw@c64.us">rajaw@c64.us</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
My Google-Fu must be running low this this morning...<br>
<br>
What creates /var/log/faillog ? I have a RHCE 6.5 server and a security<br>
auditor said that we should have a /var/log/faillog file. I have the<br>
"pam_tally2" module loaded in the auth file "system-auth-ac" . The<br>
pam_tally2 command does appear to give proper results as well.<br>
<br>
Kind regards,<br>
Raj Wurttemberg<br>
<a href="mailto:rajaw@c64.us">rajaw@c64.us</a><br>
<br>
<br>
_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</blockquote></div>