faillock

List login failures of current user

$ faillock

$ faillock --reset

$ sudo faillock

$ sudo faillock --user [user]

$ sudo faillock --user [user] --reset

faillock [options]

faillock displays and modifies authentication failure record files. Part of the PAM pam_faillock module, it tracks failed login attempts and can lock out accounts after too many failures.
Used for security monitoring and account lockout management.

--user user

Operate on specific user

Reset failure records

Use alternate tally directory

Part of the Linux-PAM package. Records stored in /var/run/faillock/ by default. Requires root to view other users' records.

pam_faillock(8), pam(8)