FAILLOG(8) System Management Commands FAILLOG(8)

.SH "NAME" faillog - display faillog records or set login failure limits

.SH "SYNOPSIS"

.HP 192u

**faillog**  
\[*options*]

.SH "DESCRIPTION"

.PP **faillog** displays the contents of the failure log database (/var/log/faillog). It can also set the failure counters and limits. When **faillog** is run without arguments, it only displays the faillog records of the users who had a login failure.

.SH "OPTIONS"

.PP The options which apply to the **faillog** command are:

.PP **-a**, **--all**

Display (or act on) faillog records for all users having an entry in the faillog database.

The range of users can be restricted with the **-u** option.

In display mode, this is still restricted to existing users but forces the display of the faillog entries even if they are empty.

With the **-l**, **-m**, **-r**, **-t** options, the users' records are changed, even if the user does not exist on the system. This is useful to reset records of users that have been deleted or to set a policy in advance for a range of users.

.RE  
.PP **-h**, **--help**

Display help message and exit.

.RE  
.PP **-l**, **--lock-secs** *SEC*

Lock account for *SEC* seconds after failed login.

Write access to /var/log/faillog is required for this option.

.RE  
.PP **-m**, **--maximum** *MAX*

Set the maximum number of login failures after the account is disabled to *MAX*.

Selecting a *MAX* value of 0 has the effect of not placing a limit on the number of failed logins.

The maximum failure count should always be 0 for *root* to prevent a denial of services attack against the system.

Write access to /var/log/faillog is required for this option.

.RE  
.PP **-r**, **--reset**

Reset the counters of login failures.

Write access to /var/log/faillog is required for this option.

.RE  
.PP **-R**, **--root** *CHROOT\_DIR*

Apply changes in the *CHROOT\_DIR* directory and use the configuration files from the *CHROOT\_DIR* directory. Only absolute paths are supported. No SELINUX support.

.RE  
.PP **-t**, **--time** *DAYS*

Display faillog records more recent than *DAYS*.

.RE  
.PP **-u**, **--user** *LOGIN*|*RANGE*

Display faillog record or maintains failure counters and limits (if used with **-l**, **-m** or **-r** options) only for the specified user(s).

The users can be specified by a login name, a numerical user ID, or a *RANGE* of users. This *RANGE* of users can be specified with a min and max values (*UID\_MIN-UID\_MAX*), a max value (*-UID\_MAX*), or a min value (*UID\_MIN-*).

.RE

.PP When none of the **-l**, **-m**, or **-r** options are used, **faillog** displays the faillog record of the specified user(s).

.SH "CAVEATS"

.PP **faillog** only prints out users with no successful login since the last failure. To print out a user who has had a successful login since their last failure, you must explicitly request the user with the **-u** flag, or print out all users with the **-a** flag.

.SH "FILES"

.PP /var/log/faillog

Failure logging file.

.RE

.SH "SEE ALSO"

.PP [**login**(1)](/man/os/shadow/login.1), [**faillog**(5)](/man/os/shadow/faillog.5).

10/25/2026 shadow-utils 4.20.3

---

Document: faillog(8) from shadow 4.20.3-r1 (Chainguard OS)
Source: https://github.com/shadow-maint/shadow