On Thu, 20 May 1999, Greg A. Woods wrote:

> [ On Thursday, May 20, 1999 at 18:31:34 (+0000), Andy Doran wrote: ]
> > Subject: Re: interface to utmp file.
> >
> > Out of interest, does the spec define failed logins as loggable in some
> > way?
> 
> Nope.  As I recall most compliant or nearly compliant systems simply log
> failed logins (attempted via login(8)) to /var/adm/loginlog if it exists.  ;-)

I have to deal with some SCO OpenServer machines here. They gleefully tout
"%d failed login attempt(s)" upon login; it got me wondering about the
spec.

> In theory though an entry with type LOGIN_PROCESS followed by an entry
> for the same "ut_line" with type DEAD_PROCESS, and no intervening entry
> for the same "ut_line" with type USER_PROCESS, would indicate that a
> failed login had been attempted on the given "ut_line".  At least I
> think that's the way the process goes... the spec. is rather vague on
> this.

Hmm. Let me see how an "Open System" like SCO does it ;).

Andy.