Hi,

I am trying to log the failed login. Although I set
SYSLOG_FAILED_LOGINS=3, syslog still logs the failed attempt right
after the first failure, instead of wait for the third failure. Here
are the settings

Solaris 9
/etc/default/login
SYSLOG_FAILED_LOGINS=3

/etc/syslog.conf
auth.notice       /var/adm/authlog

/etc/init.d/syslog stop
/etc/init.d/syslog start

Thank you,
Victor

Hi Victor,


> I am trying to log the failed login. Although I set
> SYSLOG_FAILED_LOGINS=3, syslog still logs the failed attempt right
> after the first failure, instead of wait for the third failure. Here
> are the settings

AFAIR is this setting in Solaris 9 not for syslog. Look for a file 
/var/adm/loginlog
There you can find your failed logins


Michael

Hi Michael,

I do not see /var/adm/loginlog.  In my case, the failed login has been
logged into /var/adm/authlog as indicated in the syslog.conf.

Victor

try
touch /var/adm/loginlog
chmod 600 /var/adm/loginlog
chgrp sys /var/adm/loginlog

RGDS
Mikkel

<victorfeng1973@yahoo.com> wrote in message 
news:1153325810.044573.101680@i42g2000cwa.googlegroups.com...
> Hi Michael,
>
> I do not see /var/adm/loginlog.  In my case, the failed login has been
> logged into /var/adm/authlog as indicated in the syslog.conf.
>
> Victor
>