Is there any way to keep track of number of attempts made by a user to login into his system?


On linux, logins and failed logins are logged in binary format in /var/log/wtmp and /var/log/btmp respectively. In order to view those logs in human readable format, you need to use the command last or lastb. You can also check your /var/log/auth.log (which is plain text) for successful / failed authentication attempts.

In OpenBSD there is no /var/log/btmp, but the last command works. Also, the authlog is in /var/log/authlog.

In Solaris the last command works, but (at least on the system I have access to) authlog seems to be empty.

  • Thank you very much.... Is it possible to run a program before user login?. Not like startup programs but those likely to be run once after user login. – CrazyCoder Mar 24 '11 at 18:08
  • On my system, Debian squeeze, both /var/log/wtmp and /var/log/btmp are binary files. – Faheem Mitha Mar 24 '11 at 18:51
  • Yeah those are binary files. So how will you know how many failed attempts are made before an successful login. – CrazyCoder Mar 24 '11 at 19:50
  • @Winbros: last and lastb produce a human readable output from wtmp and btmp respectively. In debian, /var/log/auth.log logs every login attempt, failed or successful. – forcefsck Mar 24 '11 at 21:27
  • @forcefsck Ok let me check – CrazyCoder Mar 25 '11 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.