I have ran the following command on my RHEL 6 system to produce an audit report
aureport --login --summary -i
that produces the following output
Login Summary Report ============================ total auid ============================ Warning - freq is non-zero and incremental flushing not selected. 458 unset 87 root
The command is said to generate a summary report of all failed login attempts per each system user according to this RHEL document.
However, wouldn't I need to use the
--failed option to produce the output for failed login attempts?
Also, how is the output of this command to be interpreted? Does it mean 87 failed logins for root, or does 87 mean something else besides the number of failed logins?