loginlog(4)

loginlog -- log of failed login attempts

Description

After LOGFAILURES unsuccessful login attempts, where LOGFAILURES is 5 if not defined in /etc/default/login, all the attempts are logged in the file /var/adm/loginlog. This file contains one record for each failed attempt. Each record contains the login name, tty specification, and time.

This is an ASCII file. Each entry is separated from the next by a new-line. Within each entry, each field is separated from the next by a colon.

By default, loginlog does not exist, so no logging is done. To enable logging, the log file must be created with read and write permission for owner only. The owner must be root; the group, sys.

Files

   /var/adm/loginlog 
   /etc/default/login

References

defadm(1M), login(1), login(4), passwd(1)