failedlogin

[sinyce]

Every day I run a cron job to get the users who failed in their attempt to login to the RS/6000 (AIX 4.3.3.10):

in the etc/security -

#who failedlogin >login.txt

This creates a text file of all the failed logins. The file is in 5 columns and a sample of two rows look thus:

root pts/1 Jul 18 15:47 (10.2.2.2)
mikej pts/7 Jul 19 12:01 (mikej.domain.)

Three questions:

1.Is there anyway to configure the "failedlogin" file generated to give more information, for some reason the NetBIOS name is truncated and sometimes it just returns the IP Address of the Workstation.

2. The date field simply returns "Jul 18" can this be configured to return the year also? like Jul 18 2002?

3. What does the pts/7 or pts/1 mean?

Any help will be much appreciated.

Sinyce

 

[Guest_imported]

1. NO its utmp/wtmp format which is quite sufficient to store IP addreses not rev names
2. NO -"- (no year there so you have to rotate utmp/wtmp and syslogs once a year at least)
3. login device relative to /dev directory
pts/* - virtual terminals
tty* - real serial ones