last few unsuccessful logins

[Joyce Suganthy]

Hi all,

My systems are all trusted systems.
I have a question.

Let's say that I have set using SAM that unsuccessful login try for a user is 10 times .

This is my id:

root@abc: /usr/lbin/getprpw -m ulogint joyces
ulogint=Fri Nov 21 09:12:30 2003

This shows that my last unsuccessful login was on Nov 21. I have had few unsuccessful login before Nov 21. Is there anyway I can extract those dates when the unsuccessful attempt was for this id???

Please help

Thanks in advance

Joyce

[steven Burgess_2]

Hi Joyce

lastb | grep

HTH

Steve

[Michael Tully]

If the oldest entry in /var/adm/btmp is Nov 21, then that will be the oldest you can possibly report on. Regardless of whether the system is trusted or not, it still uses the same file for getting this particular information. This is different to the actual number of unsuccessful attempts.

[Patrick Wallek]

# lastb username

so

# lastb joyces

Will do what you require.

[Darren Prior]

Hi Joyce,

I guess this all depends on whether you are trying to find out something that has already happened, or you want to set something up to check for this in the future.

If it's for the the future then auditing may be useful. It's going to generate a fair amount of data though. An alternative is to run a cron job each day that runs something like getprpw or logins to extract this info to see if there's been an unsuccessful attempt that day.

If you're checking for something that's already happened, then lastb is probably the only help - bearing in mind the points that others have raised.

regards,

Darren.