how to find last unsuccessful login

[billy1]

Can anyone tell me how I can find the last unsuccessful login a person has made ?

 

[BFOJ]

Try the following command and substitute the persons login name in place of <user account>.

who /etc/security/failedlogin | grep <user account>

Drop the pipe and grep if you want to see a history of failed logins. If you want to see the failed logins from the highest number to the lowest, use the following command.

who /etc/security/failedlogin|awk '{print $1}'|sort|uniq -c|sort -nr|more

 

[Butterfly123]

Simple way is to login to the machine thru telnet and after looging in, last unsuccessful login details shall be displayed on ur screen!!

Regds,

- Hemant
NSIG,
Satyam Computer Services Ltd

 

[admincff]

Look at /etc/security/lastlog

 

[AIX5L]

lsuser -a -c time_last_unsuccessful_login <username>

 

[billy1]

Thanks for your replies. They are very helpful.
The lsuser command will give me the last unsuccessful login time however I don't know what format to interpret it in. Here's my result of running the command:

#name:time_last_unsuccessful_login
otooleb:1035367262

 

[dsn1]

&quot;1035367262&quot;

This is the number of seconds since the start of the Universe ( well, 1 Jan 1970 anyway ).

Dave

 

[errpt]

but how can i translate it to yyyy:mm:dd:hh:mm:ss ?
thanks!