tallylog vs faillog
Using Red Hat 5 and trying to find a log file I can extract data from that list all accounts locked. In Red Hat 4 I pulled the data from the fiallog by typing faillog -a. Now that I'm using Pam_tally do I get the same data from the tallylog and if so is there a command switch?
Really new to Red Hat. A million thanks, John |
Not really what I wanted but it works
I’ve managed to find a way to capture the data. I observed that when an account is locked, a key value associated with the account in the audit.log file was ACCT_LOCK.
I setup a script that looks like this: ausearch --start this-week -i | grep `ACCT_LOCK’ The above puts it on the screen but I could alway insert it into a .txt file. It returns all the accounts locked in Linux for the past week. |
All times are GMT -5. The time now is 12:43 PM. |