Audit Log - Invalid User
 

Hello,
I attempted to log on with an invalid username (xxxxx). Access was denied, as I expected.

I then logged on as a user with root privileges. I tried using aureport and ausearch to find the logon attempt by the invalid user, xxxxx. I could not find it.

What are the options for aureport and ausearch that will tell me that an invalid user attempted to log on?

Thanks in advance,
Jaypas

The invalid username might not be logged because people sometimes enter their passwords in the username prompt by accident.

Sometimes systems are set to only log invalid attempts if at least n (eg 3) consecutive attempts were made and this value oftens triggers a lockout on the acct also.
Attempts to login as root may be logged separately and always for each attempt.