what controls the login message (see main body):

[john guardian]

for failed login attempts? If I've fat-fingered the login 2x, it's reported when I successfully log in on the 3rd attempt and the system reports the failed login attempts. What facility/cmd/etc performs this task? Is it controlled by login?

Thx.

[Ismail Azad]

Hi,

I first thought this had something to do with a trusted system. But this definitely happens on a 11.31 "standard" system as well {although yes t/s is deprecated on this O.S}. Manual pages indicate that login optionally also provides this message.

You may look into the functionality of the attribute DISPLAY_LAST_LOGIN which would be an interesting attribute for your problem.

Check man 4 security

Regards
Ismail Azad