btmp file is not populating

[Terry Conrad]

I have an old system still at HP-UX version 11.11. The btmp file does not populate (wtmp does). Any ideas on this? I do not have a lot of failed logins on this machine, but I know there are some.

[Dennis Handly]

What was the last modification date?

[Terry Conrad]

It was last modified earlier today  (actually created earlier today, as I tried removing it and re-creating it).

It had no failed login information then, and is still not tracking failed logins

[pradeep m]

What is the output of the below commands? does it fail with any errror?

# lastb 

or 

# lastb -R

/var/adm/btmps stores the bad login details. The "lastb" command reads the /var/adm/btmps for bad login details. 

If you find any error reported for the above command, try to rename the btmps file and recreate and check it.

# mv /var/adm/btmps /var/adm/btmps.old

# touch /var/adm/btmps

Now try to login the server with invalid user/password, so the  /var/adm/btmps file get updated.

# lastb -R (check if the command lists the expected output)

for details refer the man page of "lastb". 

[Terry Conrad]

this box is still 11iv1, so I think it uses btmp

lastb and lastb -R return only 'btmp begins Wed Feb 29 10:15' (that btmp file is empty)

I did rename the old file, touch a new one, and mis-type my login...again, the file is totally empty

I have tried different owner and group permissions on this file; different read/write/execute permissions on this file; I can not get failed logins to write there

[Terry Conrad]

an update...

This is an old box, but is still in use. It does not normally have a console connected to it. Telnet is not available on this box, I get to it with ssh. I hooked our console to this server, and mis-typed my login. This did show up as a failed login.

Is it possible failed ssh logins are written somewhere else, or not at all?

[Bill Hassell · Accepted solution]

telnet sends bad login information to the btmp file but ssh is a self-contained authentication system, so it logs failed attempts in syslog using the "auth" facility. Look for "failed" in syslog (there may unrelated failed messages). A better way to handle authentication is to create a separate log just for authentication and pull out all the "auth" records from syslog. Do this with syslog.conf:

*.info;mail.none;auth.none       /var/adm/syslog/syslog.log

auth.info       /var/adm/syslog/auth.log

NOTE: *NO* spaces allowed on any line except comments. Put another way, any space character turns the entire line (silently) into a coment. Use tabs.

What the above lines do is to log all info messages except no logging of anything for mail and auth records. The second line sends all auth records to the file: /var/adm/syslog/auth.log

This (ssh logging) is standard behavior for all versions of HP-UX.