3.6.3 Viewing Failed Operating System Password Attempts
Use the faillock
operating system utility to view failed
login attempts.
For example, to see the failed login attempts for the
celladmin
user:
# faillock --user celladmin
celladmin:
When Type Source Valid
2022-11-06 18:23:18 RHOST xxx.xxx.xxx.xxx V
2022-11-06 18:23:23 RHOST xxx.xxx.xxx.xxx V
2022-11-06 18:23:27 RHOST xxx.xxx.xxx.xxx V
In the example output, xxx.xxx.xxx.xxx represents the IP address that is the source of the login failure.