[ale] What creates /var/log/faillog ?

[Shawn]

http://www.cyberciti.biz/faq/faillog-in-linux-command/

On Mon, Sep 22, 2014 at 10:55 AM, Paul Cartwright <pbcartwright at gmail.com>
wrote:

> # file /var/log/faillog
> /var/log/faillog: data
>
> # strings /var/log/faillog
> pauls-server:/home/pbc #
>
>
>
> > Paul, what does "file /var/log/faillog" say? How about "strings
> > /var/log/faillog"?
> >
> > Of course, it could have been a file that's held open but already
> removed.
> >
> >
> >
> > On Mon, Sep 22, 2014 at 10:13 AM, Paul Cartwright
> > <pbcartwright at gmail.com> wrote:
> >> weird... I have a faillog, but it looks like a data file. when I try
> >> more, it shows blanks..
> >>
> >> ls -l /var/log/faillog
> >> -rw------- 1 root root 32000 Sep 11 14:57 /var/log/faillog
> >> pauls-server:/home/pbc # tail /var/log/faillog
> >> pauls-server:/home/pbc #
> >>
> >>
> >> tail shows nothing either..
> >>
> >>> Never heard of a "faillog". There is secure and audit logs.
> /var/log/secure
> >>> handles login attempts. If auditd is running, /var/log/audit/* handles
> all
> >>> manner of access internal to the system (I.e. not web server access).
> >>> Perhaps those are what was inferred.
> >>> On Sep 22, 2014 9:43 AM, "Raj Wurttemberg" <rajaw at c64.us> wrote:
> >>>
> >>>> My Google-Fu must be running low this this morning...
> >>>>
> >>>> What creates /var/log/faillog ? I have a RHCE 6.5 server and a
> security
> >>>> auditor said that we should have a /var/log/faillog file. I have the
> >>>> "pam_tally2" module loaded in the auth file "system-auth-ac" .  The
> >>>> pam_tally2 command does appear to give proper results as well.
> >>>>
> >>>> Kind regards,
> >>>> Raj Wurttemberg
> >>>> rajaw at c64.us
> >>>>
> >>>>
> >>>> _______________________________________________
> >>>> Ale mailing list
> >>>> Ale at ale.org
> >>>> http://mail.ale.org/mailman/listinfo/ale
> >>>> See JOBS, ANNOUNCE and SCHOOLS lists at
> >>>> http://mail.ale.org/mailman/listinfo
> >>>>
> >>> -------------- next part --------------
> >>> An HTML attachment was scrubbed...
> >>> URL: <
> http://mail.ale.org/pipermail/ale/attachments/20140922/cb52c48d/attachment.html
> >
> >>> _______________________________________________
> >>> Ale mailing list
> >>> Ale at ale.org
> >>> http://mail.ale.org/mailman/listinfo/ale
> >>> See JOBS, ANNOUNCE and SCHOOLS lists at
> >>> http://mail.ale.org/mailman/listinfo
> >>>
> >>>
> >>
> >> --
> >> Paul Cartwright
> >> Registered Linux User #367800 and new counter #561587
> >>
> >> _______________________________________________
> >> Ale mailing list
> >> Ale at ale.org
> >> http://mail.ale.org/mailman/listinfo/ale
> >> See JOBS, ANNOUNCE and SCHOOLS lists at
> >> http://mail.ale.org/mailman/listinfo
> >
> >
>
>
> --
> Paul Cartwright
> Registered Linux User #367800 and new counter #561587
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>



-- 
*- Shawn Taaj*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.ale.org/pipermail/ale/attachments/20140922/a225e8e0/attachment.html>