Logs
 

Where are logs put of login failures, what might these look like?

/var/log/secure shows all logins plus failed logins

Mine login logs are in /var/log/auth.log

Once that file fills up auth.log.0 will be made and so on.... but auth.log is the most current. If you read that file you'll be able to tell which ones were failures, as it'll say

Feb 7 07:26:43 homer kde(pam_unix)[5519]: authentication failure; blah

The blah tells you more details that I don't particular feel comfortable giving out:)

That particular login failure was with kde, it also shows console logins and ssh logins and what not.

I don't have an auth.log but I found that info in messages... I posted it in "Can't Login As Regular User After Trying..." is that bad? can you take a look?