Re: Sarge: Lost # of failed logins
On Fri, Jul 27, 2007 at 20:14:02 -0500, Mumia W.. wrote:
> On 07/27/2007 05:55 PM, Andrew Sackville-West wrote:
>> On Fri, Jul 27, 2007 at 02:53:54PM -0500, Mumia W.. wrote:
>>> [...]
>>> The "faillog" command doesn't give any output to me, and /var/log/faillog
>>> is still zero bytes.
>> so, what mechanism writes the faillog. Maybe it panics on bad perms?
>> mine are 0644 root:root
>> A
>
> Same here.
I can remove /var/log/faillog on my system (Sid-amd64) and create a new
one with "touch" (empty file, permissions like yours). After the first
failed login the file is 32KB long (the same length as it had before)
and both the login failure messages and the faillog command work
normally again.
I would of course be very worried if the faillog file disappeared on its
own all of a sudden. (Now that I have become aware of its existence in
the course of this thread.) Likewise, it would be suspicious if the
empty "seed" file remained unchanged after subsequent login failures.
--
Regards, | http://users.icfo.es/Florian.Kulzer
Florian |
Reply to: