FAILLOG(8)

🌸 faillog(8) — the girl's guide to the failure log 🌸

Okay bestie, so this is faillog, a system management command from the Unix fam. It lives in section 8 of the manual (that's the admin section, very main character energy) and it's literally about tracking who fumbled their login.

---

✨ NAME ✨

faillog — display faillog records or set login failure limits. That's it, that's the whole vibe check: it shows you the receipts of failed logins, and it can also set the limits and counters.

---

🎀 SYNOPSIS 🎀

faillog [options]

That's the whole thing. No positional weirdness, no subcommands, just vibes and options.

---

💖 DESCRIPTION 💖

So like, faillog displays the contents of the failure log database — which lives at /var/log/faillog, in case you were wondering. It can also set the failure counters and limits, so it's not just a read-only princess, she does stuff too.

When you run faillog with no arguments at all? It only displays the faillog records of the users who actually had a login failure. Not everybody — just the ones who messed up. The way that's such a mood.

---

🦋 OPTIONS 🦋

These are the options that apply to the faillog command, bestie. All of them. Every single one. No skipping:

• -a, --all — Display (or act on) faillog records for all users having an entry in the faillog database.
  • The range of users can be restricted with the -u option.
  • In display mode, this is still restricted to existing users, but it forces the display of the faillog entries even if they are empty. Empty entries deserve screen time too 💅
  • With the -l, -m, -r, -t options, the users' records are changed — even if the user does not exist on the system. Which is lowkey iconic honestly, it's useful to reset records of users that have been deleted, or to set a policy in advance for a range of users.
• -h, --help — Display help message and exit. The classic "bestie, explain" move.
• -l, --lock-secs SEC — Lock the account for SEC seconds after a failed login. Yes, an actual number of seconds, you don't get to be vague about this one.

Heads up: write access to /var/log/faillog is required for this option. No write access, no locking. Periodt.

• -m, --maximum MAX — Set the maximum number of login failures after the account is disabled to MAX.
  • Selecting a MAX value of 0 has the effect of not placing a limit on the number of failed logins. Zero means unlimited here, which is giving chaotic neutral.
  • The maximum failure count should always be 0 for root, to prevent a denial of services attack against the system. This one's serious, bestie — fr fr.

Write access to /var/log/faillog is required for this option. Again.

• -r, --reset — Reset the counters of login failures. Fresh start, clean slate, new era ✨

And yes — write access to /var/log/faillog is required for this option.

• -R, --root CHROOT_DIR — Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory. Only absolute paths are supported. Like, don't come at it with a relative path, it will not be charmed.
• -t, --time DAYS — Display faillog records more recent than DAYS. Just the recent drama, please.
• -u, --user LOGIN|RANGE — Display the faillog record, or maintain failure counters and limits (if used with the -l, -m, or -r options), only for the specified user(s).
  • The users can be specified by a login name, a numerical user ID, or a RANGE of users.
  • That RANGE of users can be specified with a min and max value (UID_MIN-UID_MAX), a max value (-UID_MAX), or a min value (UID_MIN-).

And here's the lil rule that ties it all together: when none of the -l, -m, or -r options are used, faillog displays the faillog record of the specified user(s). Read-only mode, we're just looking 👀

---

💀 CAVEATS 💀

Okay this part matters, don't scroll past:

faillog only prints out users with no successful login since the last failure. So if someone failed, then logged in successfully after? They're invisible to the default output. Not ghosted by us — ghosted by the tool.

To print out a user who has had a successful login since their last failure, you must explicitly request the user with the -u flag, or print out all users with the -a flag. There is no third option. I checked.

---

🍓 FILES 🍓

• /var/log/faillog — the failure logging file. That's her. That's the whole file list, she's the only one.

---

🌈 SEE ALSO 🌈

• login(1)
• faillog(5)

Go read those too, iykyk 🫶

---

💜 that's the whole page, bestie — go forth and check your failure logs 💜

Sign-off time: this little masterpiece is from shadow-utils 4.13, dated 05/30/2024. Slay. 🎀