loginlog - log of failed login attempts
After five unsuccessful login attempts, all the attempts are logged in the file /var/adm/loginlog. This file contains one record for each failed attempt. Each record contains the login name, tty specification, and time.
This is an ASCII file. Each field within each entry is separated from the next by a colon. Each entry is separated from the next by a new-line.
By default, loginlog does not exist, so no logging is done. To enable logging, the log file must be created with read and write permission for owner only. Owner must be root and group must be sys.