In Linux you can use faillog command to display failed login attempts or you can set login failure limits. faillog formats the contents of the failure log from /var/log/faillog database / secure log file. It also can be used for maintains failure counters and limits.
For RHEL/CentOS Linux 5.x, you need to modify /etc/pam.d/system-auth file to monitor or track failed login attempts. You need to configure PAM module pam_tally.so. Otherwise faillog command will never display failed login attempts.
STEP 1: Open /etc/pam.d/system-auth file:
# vim /etc/pam.d/system-auth
Append following two pam_tally.so modules:

auth required pam_tally.so no_magic_root
account required pam_tally.so deny=5 no_magic_root lock_time=120
Where,
deny=5 : Deny access if tally for this user exceeds 5 times.
lock_time=120 : Always deny for 120 seconds after failed attempt.

magic_root : If the module is invoked by a user with uid=0 the counter is not incremented. The sys-admin should use this for user launched services, like su, otherwise this argument should be omitted.
no_magic_root : Avoid root account locking, if the module is invoked by a user with uid=0
Save and close the file.
STEP 2: Now, to display failed login attempts for dhaval,

# faillog -u dhaval
Login Failures Maximum Latest On
dhaval 2 0 10/07/10 14:12:53 -0600 122.11.xx.yy
STEP 3: To display failed login attempts for all users, use the -a option:

# faillog -a
Login Failures Maximum Latest On
root 0 0 10/07/10 14:49:52 +0530 tty1
dhaval 0 0 10/07/10 22:05:03 +0530 tty1
If you want to reset the counter use  -r option. If you want to reset particular users failed attempts, use -u USERNAME option:

# faillog -r

# faillog -r -u dhaval

Related Articles: