AIX 5.3 - How to check for failed login attempts
AIX failed login attempts, check failed login attempts on AIXHow to check for failed login attempts on AIX
AIX 5.x logs failed login attempts to /etc/security/failedlogin file (don't try to head/grep/tail it, it's data or International Language text)
Code:
$ file /etc/security/failedlogin
/etc/security/failedlogin: data or International Language text
To be able to read this file and list failed login attempts, use who -a /etc/security/failedlogin command:
Code:
$ who -a /etc/security/failedlogin
root - ssh Jan 21 09:43 ?
root - ssh Jan 21 13:25 ?
root - ssh Jan 21 14:36 ?
root - ssh Jan 22 10:35 ?
root - ssh Jan 22 14:34 ?
root - ssh Jan 22 14:34 ?
root - ssh Jan 22 14:34 ?
root - ssh Jan 22 16:49 ?
root - ssh Jan 22 18:46 ?
root - ssh Jan 22 22:36 ?
root - ssh Jan 23 11:51 ?
root - ssh Jan 23 13:58 ?
root - ssh Jan 23 14:13 ?
root - ssh Jan 23 14:24 ?
root - ssh Jan 23 17:03 ?
root - ssh Jan 24 06:35 ?