FAILLOG(5)

💖 FAILLOG(5) — the login-failure diary, bestie edition 💖

okay so real talk, this page is faillog from the File Formats and Configuration corner of the manual universe, and it's basically the receipts file for failed logins. let's get into it 🫶

---

✨ NAME ✨

faillog — the login failure logging file. that's it, that's the whole vibe 💅

---

🌸 DESCRIPTION 🌸

/var/log/faillog is out here maintaining a count of login failures and the limits for each account. like it's the group chat that remembers everyone's L's 📝

The file contains fixed length records, indexed by numerical UID. no cap, every record is the same size and you find yours by UID, iconic indexing behavior 👑

Each record contains:

• the count of login failures since the last successful login
• the maximum number of failures before the account is disabled
• the line on which the last login failure occurred
• the date of the last login failure
• and the duration (in seconds) during which the account will be locked after a failure

so basically everything you'd want to know about someone fumbling their password 😭 the whole story, in one record.

The structure of the file is:

struct    faillog {
     short   fail_cnt;
     short   fail_max;
     char    fail_line[12];
     time_t  fail_time;
     long    fail_locktime;
};

that's the exact struct, don't touch it, she's perfect the way she is ✨

---

🎀 FILES 🎀

• /var/log/faillog — Failure logging file. this is the file. the main character. the one doing all the work 💖

---

🦋 SEE ALSO 🦋

• faillog(8) — go read her sister page, iykyk 🔥

---

ngl bestie, this file is doing a lot of quiet emotional labor for your system's security. respect her 🙈

---

and that's the whole page! brought to you by shadow-utils 4.13, dated 05/30/2024 — mwah, stan the shadow-utils girlies 💜✨