so do we all agree that faillog is not working? recall :faillog (part of the login package) should track failled login attempt in a the binary file /var/log/faillog
/var/log/faillog is read with the faillog command : faillog -a or faillog -u <user> it doesn't report any fail and the last date is always epoch