Audit failed local user login

[Marinus]

Hi,

for a audit script I'm developing, I'd like to get a summary of
failed local user login attempts (not sshd failed logins) (wrong password,
user does not exist).
They are not logged in /var/log/messages

Is there a log file or a command for this?

Thanks,

Marinus.

[Vergil83]

Try

 lastb -f /var/log/btmp

lastb(1): of last logged in users - Linux man page

[Marinus]

Hi Vergil,

yes that works on Debian but..

do you know a Linux wide equivalent? This script will be deployed to various distributions and for example on SuSE /var/log/btmp is not available.
Even if you create it and set the right permissions it is not written to.

Marinus.