Jan Danielsson wrote:
...
>    However, /var/log/authlog is getting rotated, but I can't figure
> where/how often, etc. If I would perform a query at a "bad time", I
> assume the log entry could have been archived. So I would like to find a
> more fail safe way to catch the "bad logins".
> 
...

Hi,

Don't know if this answers the rest of your questions but authlog is
probably being rotated by newsyslog(8).  You can just comment out the
appropriate line in /etc/newsyslog.conf if you want to prevent that from
happening.

HTH,

adrian.