3.6.3 Viewing Failed Operating System Password Attempts

Use the faillock operating system utility to view failed login attempts.

For example, to see the failed login attempts for the celladmin user:

# faillock --user celladmin
celladmin:
When                Type  Source                                           Valid
2022-11-06 18:23:18 RHOST xxx.xxx.xxx.xxx                                      V
2022-11-06 18:23:23 RHOST xxx.xxx.xxx.xxx                                      V
2022-11-06 18:23:27 RHOST xxx.xxx.xxx.xxx                                      V

In the example output, xxx.xxx.xxx.xxx represents the IP address that is the source of the login failure.