tallylog vs faillog

mccartjd · 08-06-2010, 08:48 AM

Using Red Hat 5 and trying to find a log file I can extract data from that list all accounts locked. In Red Hat 4 I pulled the data from the fiallog by typing faillog -a. Now that I'm using Pam_tally do I get the same data from the tallylog and if so is there a command switch?

Really new to Red Hat.

A million thanks,
John

mccartjd · 08-06-2010, 03:50 PM

I’ve managed to find a way to capture the data. I observed that when an account is locked, a key value associated with the account in the audit.log file was ACCT_LOCK.

I setup a script that looks like this:

ausearch --start this-week -i | grep `ACCT_LOCK’

The above puts it on the screen but I could alway insert it into a .txt file. It returns all the accounts locked in Linux for the past week.