On Linux, lastb is the same as last, but it shows a log of the file /var/log/btmp, which contains all the bad login attempts.

root@lnxa24 ~# lastb
NoSuchUs ssh:notty    lnx000a9.mydom.org Sun Apr  2 16:32 – 16:32  (00:00)
NoSuchUs ssh:notty    lnx000a9. mydom.org Sun Apr  2 16:32 – 16:32  (00:00)
NoSuchUs ssh:notty    lnx000a9. mydom.org Sat Apr  1 16:41 – 16:41  (00:00)
NoSuchUs ssh:notty    lnx000a9. mydom.org Sat Apr  1 16:40 – 16:40  (00:00)
 
btmp begins Sat Apr  1 16:40:36 2017

Comments are closed.