I was checking the wrong password attempts on the systems and observed the following:

"ls -lrt /var/log/faillog" output:

-rw------- 1 root root 32320 Oct 10 06:15 var/log/faillog

So the last modification time of /var/log/faillog is "Oct 10 06:15".

Whereas from the output of "faillog -a" command, I can see that last such attempt was made on "08/26/11".

"faillog -a" output:

Login Failures Maximum Latest On
oamsys 1 0 08/26/11 15:41:50 -0500 localhost

Question: Why is the file showing a different modification time than the one displayed by "faillog -a". faillog command uses contents of /var/log/faillog to display wrong password attempts.

Could be related to last recorded successful login?

1 members found this post helpful.

That seems to be the only possible reason