[ale] What creates /var/log/faillog ?

[Paul Cartwright]

# file /var/log/faillog
/var/log/faillog: data

# strings /var/log/faillog
pauls-server:/home/pbc #



> Paul, what does "file /var/log/faillog" say? How about "strings
> /var/log/faillog"?
>
> Of course, it could have been a file that's held open but already removed.
>
>
>
> On Mon, Sep 22, 2014 at 10:13 AM, Paul Cartwright
> <pbcartwright at gmail.com> wrote:
>> weird... I have a faillog, but it looks like a data file. when I try
>> more, it shows blanks..
>>
>> ls -l /var/log/faillog
>> -rw------- 1 root root 32000 Sep 11 14:57 /var/log/faillog
>> pauls-server:/home/pbc # tail /var/log/faillog
>> pauls-server:/home/pbc #
>>
>>
>> tail shows nothing either..
>>
>>> Never heard of a "faillog". There is secure and audit logs. /var/log/secure
>>> handles login attempts. If auditd is running, /var/log/audit/* handles all
>>> manner of access internal to the system (I.e. not web server access).
>>> Perhaps those are what was inferred.
>>> On Sep 22, 2014 9:43 AM, "Raj Wurttemberg" <rajaw at c64.us> wrote:
>>>
>>>> My Google-Fu must be running low this this morning...
>>>>
>>>> What creates /var/log/faillog ? I have a RHCE 6.5 server and a security
>>>> auditor said that we should have a /var/log/faillog file. I have the
>>>> "pam_tally2" module loaded in the auth file "system-auth-ac" .  The
>>>> pam_tally2 command does appear to give proper results as well.
>>>>
>>>> Kind regards,
>>>> Raj Wurttemberg
>>>> rajaw at c64.us
>>>>
>>>>
>>>> _______________________________________________
>>>> Ale mailing list
>>>> Ale at ale.org
>>>> http://mail.ale.org/mailman/listinfo/ale
>>>> See JOBS, ANNOUNCE and SCHOOLS lists at
>>>> http://mail.ale.org/mailman/listinfo
>>>>
>>> -------------- next part --------------
>>> An HTML attachment was scrubbed...
>>> URL: <http://mail.ale.org/pipermail/ale/attachments/20140922/cb52c48d/attachment.html>
>>> _______________________________________________
>>> Ale mailing list
>>> Ale at ale.org
>>> http://mail.ale.org/mailman/listinfo/ale
>>> See JOBS, ANNOUNCE and SCHOOLS lists at
>>> http://mail.ale.org/mailman/listinfo
>>>
>>>
>>
>> --
>> Paul Cartwright
>> Registered Linux User #367800 and new counter #561587
>>
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://mail.ale.org/mailman/listinfo/ale
>> See JOBS, ANNOUNCE and SCHOOLS lists at
>> http://mail.ale.org/mailman/listinfo
>
>


-- 
Paul Cartwright
Registered Linux User #367800 and new counter #561587