faillog

Install

# Usually included in the shadow-utils package

# RHEL / Alma / Rocky
sudo dnf install shadow-utils

# Debian / Ubuntu
sudo apt install passwd

# openSUSE
sudo zypper install shadow

# Arch
sudo pacman -S shadow

What it does

faillog displays or modifies the failure count and lock information stored for user accounts. It reads data from /var/log/faillog and is often used in conjunction with PAM modules such as pam_faillock or legacy login failure tracking.

How it works (mechanical)

• Reads binary records from /var/log/faillog.
• Tracks failed login attempts per user ID.
• Works alongside PAM policies that define lockout thresholds.
• Can reset or modify failure counters.
• Requires root privileges for modification.

Quick Start

# Show failure records for all users
sudo faillog

10 Practical Examples

# 1) Show all users with recorded failures
sudo faillog

# 2) Show failure record for one user
sudo faillog -u username

# 3) Reset failure count for a user
sudo faillog -r -u username

# 4) Set max login failures allowed
sudo faillog -m 5 -u username

# 5) Set lock time (in days) after max failures
sudo faillog -l 7 -u username

# 6) Reset all failure records (use with caution)
sudo faillog -r

# 7) Display only users with failures
sudo faillog -a

# 8) Combine with grep for filtering
sudo faillog | grep username

# 9) Check PAM configuration for lockout policy
grep faillock /etc/pam.d/*

# 10) Verify user account status after reset
sudo faillog -u username
sudo id username

Notes & Gotchas

• Modern systems may prefer faillock instead of faillog.
• Clearing failure logs may impact audit/security tracking.
• Ensure PAM policies align with faillog settings.
• Binary log file — do not edit manually.
• Requires root for modifications.

Historical Context

faillog originated as part of traditional Unix shadow password management. It tracked failed login attempts before more advanced PAM-based lockout mechanisms became standard.

Modern Equivalent

Modern Linux distributions typically use faillock with PAM modules (pam_faillock.so) for more granular account lockout control. faillog may still exist for compatibility.

Related Commands

• faillock — modern account lock tracking tool.
• pam_tally2 — legacy failure counter tool.
• passwd — manage user passwords.
• chage — manage password aging policies.
• id — verify user identity and groups.