invalid logins not registered in syslog

[Jacques Carriere]

I perform a su - oracle and the entry is automatically added to syslog. I perform login root with an invalid password and I don't get any entry in syslog.

Can somebody help?

[Pete Randall · Accepted solution]

Check /var/adm/btmp.


Pete

[Mark Fenton]

# lastb -R root |head

displays the last ten failed login attempts for root with remote system name, time, etc.

[doug hosking]

As previously noted, the lastb command is likely a better way of doing what you want in this case. Keep in mind that syslog files can grow rapidly. Because of this, many system administrators routinely rotate and truncate them. lastb files grow much more slowly, and therefore are more likely to preserve important information for longer periods of time.

Another reason that syslog files are not used is simply for efficiency reasons. Just as most people don't put every piece of paper into one folder in a file cabinet because it makes it hard to find things when needed, putting everything into syslog.log would also make it hard to figure out what's important and to find the important things quickly.