Help Account Lockout Event Recording Red Hat 5
 

Just when I thought I was recording account lockouts in my RedHat 5 system I find out I am not. The account lockout as designed so the Pam_tally2 module is performing as it should. I just don't see any record or log of the accounts being locked. I'm new to Linux so should I see this account lockout record in the secure or message logs? For RedHat 4 I read that if I go in the syslog.conf and add:

# Log authentication history
auth.* /var/log/authlog
[root]# ps -auxw|grep syslogd
[root]# kill -HUP process-id-of-syslogd
This will record login failures and account lockout in the file /var/log/authlog. Does this work for RHEL 5?

yes

though maybe you need "authpriv" instead of auth