How to list failed login attempts?

[arcull]

Hi guys,

I would like to know how to list failed login attempts on Ubuntu system (console and ssh). I've googled a bit and found out command

faillog

, but it doesn't print the deliberately failed log in, don't know why. I remember on Suse I did grep the /var/log/messages to get the ssh failed logins. How do I it on ubuntu? Advices much appreciated, thanks.

[Lars Noodén]

Check in /var/log/auth.log, that's where the failed attempts should be recorded.

[arcull]

Check in /var/log/auth.log, that's where the failed attempts should be recorded.

very good, thanks