/var/log/faillog maintains a count of login failures and the limits for each account.
The file contains fixed length records, indexed by numerical UID. Each record contains the count of login failures since the last successful login; the maximum number of failures before the account is disabled; the line on which the last login failure occurred; the date of the last login failure; and the duration (in seconds) during which the account will be locked after a failure.
Strukturen för filen är:
struct faillog {
short fail_cnt;
short fail_max;
char fail_line[12];
time_t fail_time;
long fail_locktime;
};
/var/log/faillog
faillog(8)