On 27/07/11, Renato wrote: | no, didn't know it conflicted with lastb. However, stopping it doesn't | change the situtation, bad logins aren't logged to /var/log/btmp. | | Can I configure syslog-ng to report bad login attempts? Dude, it's not syslog-ng. Read the man pages, for example "man lastb" says: NOTES The files wtmp and btmp might not be found. The system only logs information in these files if they are present. This is a local configuration issue. If you want the files to be used, they can be created with a simple touch(1) command (for example, touch /var/log/wtmp). These are also clues (in the same man page): SEE ALSO shutdown(8), login(1), init(8) -- Simon Perry (aka Pezz)