I need to list all the failed log in users as part of audit report. How can I do so in Linux to find all the audit log records and then upload to a table for future reference. I am using oracle 10g on Linux. Hope I will get a quick response from the experts.
Thanks in advance for the tips.
You might look at the faillog command, if your systems are linux. However, as near as I can tell, this doesn't catch things like ssh keybased auth.
In all likelihood, the most comprehensive way is to parse syslog files. That's not terribly hard, at least if you have your logging centralized to one server.
If you are talking about failed unix logins, check out the "lastb" command.
The strategy depends on how long you keep your wtmp and btmp data files.
If you are takling about Oracle, then you'll need to locate the right log (or table) if your system maintains such records.
Thanks everyone for giving some tips. However, I need a proper script to separate the failed log ins from a pool of all the log ins. I have a list of all the log ins in the form of .aud files from which I cannot find the failed ones. The script has all the details like linux node, userid, sessionid,objname, activity etc. Note that, I got most of the columns in sys.aud$ table. If anyone can guide me more in this regard, it will be a good help for me.
Thanks.