Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides
https://forum.ivorde.com/

AIX 5.3 - How to check for failed login attempts
https://forum.ivorde.com/aix-5-3-how-to-check-for-failed-login-attempts-t19735.html
Page 1 of 1

Author:  mandrei99 [ Tue Jan 20, 2015 5:25 pm ]
Post subject:  AIX 5.3 - How to check for failed login attempts

AIX failed login attempts, check failed login attempts on AIX

How to check for failed login attempts on AIX
AIX 5.x logs failed login attempts to /etc/security/failedlogin file (don't try to head/grep/tail it, it's data or International Language text)

Code:
$ file /etc/security/failedlogin
/etc/security/failedlogin: data or International Language text

To be able to read this file and list failed login attempts, use who -a /etc/security/failedlogin command:

Code:
$ who -a /etc/security/failedlogin
root      - ssh         Jan 21 09:43      ?
root      - ssh         Jan 21 13:25      ?
root      - ssh         Jan 21 14:36      ?
root      - ssh         Jan 22 10:35      ?
root      - ssh         Jan 22 14:34      ?
root      - ssh         Jan 22 14:34      ?
root      - ssh         Jan 22 14:34      ?
root      - ssh         Jan 22 16:49      ?
root      - ssh         Jan 22 18:46      ?
root      - ssh         Jan 22 22:36      ?
root      - ssh         Jan 23 11:51      ?
root      - ssh         Jan 23 13:58      ?
root      - ssh         Jan 23 14:13      ?
root      - ssh         Jan 23 14:24      ?
root      - ssh         Jan 23 17:03      ?
root      - ssh         Jan 24 06:35      ?

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/