Call script on password fail

[bear24rw]

Is there anyway to call a script when a password fails at login/unlock? I know i can poll /var/log/auth.log but is there a way to have it interrupt driven?

[HermanAB]

Hmm, login is handled by PAM and it is usually configured in /etc/pam.d. You may be able to do what you want by modifying something there. However, first make a backup of the whole pam.d directory, since any syntax error will lock you out of your machine, so then you need to be able to boot in single user mode and fix it from the backup.