{
    "mode": "man",
    "parameter": "faillog",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/faillog/8/json",
    "generated": "2026-06-13T20:01:50Z",
    "synopsis": "faillog [options]",
    "sections": {
        "NAME": {
            "content": "faillog - display faillog records or set login failure limits\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "faillog [options]\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "faillog displays the contents of the failure log database (/var/log/faillog). It can also set\nthe failure counters and limits. When faillog is run without arguments, it only displays the\nfaillog records of the users who had a login failure.\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "The options which apply to the faillog command are:\n",
            "subsections": [
                {
                    "name": "-a --all",
                    "content": "Display (or act on) faillog records for all users having an entry in the faillog\ndatabase.\n\nThe range of users can be restricted with the -u option.\n\nIn display mode, this is still restricted to existing users but forces the display of the\nfaillog entries even if they are empty.\n\nWith the -l, -m, -r, -t options, the users' records are changed, even if the user does\nnot exist on the system. This is useful to reset records of users that have been deleted\nor to set a policy in advance for a range of users.\n",
                    "flag": "-a",
                    "long": "--all"
                },
                {
                    "name": "-h --help",
                    "content": "Display help message and exit.\n",
                    "flag": "-h",
                    "long": "--help"
                },
                {
                    "name": "-l --lock-secs",
                    "content": "Lock account for SEC seconds after failed login.\n\nWrite access to /var/log/faillog is required for this option.\n",
                    "flag": "-l",
                    "long": "--lock-secs"
                },
                {
                    "name": "-m --maximum",
                    "content": "Set the maximum number of login failures after the account is disabled to MAX.\n\nSelecting a MAX value of 0 has the effect of not placing a limit on the number of failed\nlogins.\n\nThe maximum failure count should always be 0 for root to prevent a denial of services\nattack against the system.\n\nWrite access to /var/log/faillog is required for this option.\n",
                    "flag": "-m",
                    "long": "--maximum"
                },
                {
                    "name": "-r --reset",
                    "content": "Reset the counters of login failures.\n\nWrite access to /var/log/faillog is required for this option.\n",
                    "flag": "-r",
                    "long": "--reset"
                },
                {
                    "name": "-R --root",
                    "content": "Apply changes in the CHROOTDIR directory and use the configuration files from the\nCHROOTDIR directory.\n",
                    "flag": "-R",
                    "long": "--root"
                },
                {
                    "name": "-t --time",
                    "content": "Display faillog records more recent than DAYS.\n",
                    "flag": "-t",
                    "long": "--time"
                },
                {
                    "name": "-u --user",
                    "content": "Display faillog record or maintains failure counters and limits (if used with -l, -m or\n-r options) only for the specified user(s).\n\nThe users can be specified by a login name, a numerical user ID, or a RANGE of users.\nThis RANGE of users can be specified with a min and max values (UIDMIN-UIDMAX), a max\nvalue (-UIDMAX), or a min value (UIDMIN-).\n\nWhen none of the -l, -m, or -r options are used, faillog displays the faillog record of the\nspecified user(s).\n",
                    "flag": "-u",
                    "long": "--user"
                }
            ]
        },
        "CAVEATS": {
            "content": "faillog only prints out users with no successful login since the last failure. To print out a\nuser who has had a successful login since their last failure, you must explicitly request the\nuser with the -u flag, or print out all users with the -a flag.\n",
            "subsections": []
        },
        "FILES": {
            "content": "/var/log/faillog\nFailure logging file.\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "login(1), faillog(5).\n\n\n\nshadow-utils 4.8.1                           02/06/2024                                   FAILLOG(8)",
            "subsections": []
        }
    },
    "summary": "faillog - display faillog records or set login failure limits",
    "flags": [
        {
            "flag": "-a",
            "long": "--all",
            "arg": null,
            "description": "Display (or act on) faillog records for all users having an entry in the faillog database. The range of users can be restricted with the -u option. In display mode, this is still restricted to existing users but forces the display of the faillog entries even if they are empty. With the -l, -m, -r, -t options, the users' records are changed, even if the user does not exist on the system. This is useful to reset records of users that have been deleted or to set a policy in advance for a range of users."
        },
        {
            "flag": "-h",
            "long": "--help",
            "arg": null,
            "description": "Display help message and exit."
        },
        {
            "flag": "-l",
            "long": "--lock-secs",
            "arg": null,
            "description": "Lock account for SEC seconds after failed login. Write access to /var/log/faillog is required for this option."
        },
        {
            "flag": "-m",
            "long": "--maximum",
            "arg": null,
            "description": "Set the maximum number of login failures after the account is disabled to MAX. Selecting a MAX value of 0 has the effect of not placing a limit on the number of failed logins. The maximum failure count should always be 0 for root to prevent a denial of services attack against the system. Write access to /var/log/faillog is required for this option."
        },
        {
            "flag": "-r",
            "long": "--reset",
            "arg": null,
            "description": "Reset the counters of login failures. Write access to /var/log/faillog is required for this option."
        },
        {
            "flag": "-R",
            "long": "--root",
            "arg": null,
            "description": "Apply changes in the CHROOTDIR directory and use the configuration files from the CHROOTDIR directory."
        },
        {
            "flag": "-t",
            "long": "--time",
            "arg": null,
            "description": "Display faillog records more recent than DAYS."
        },
        {
            "flag": "-u",
            "long": "--user",
            "arg": null,
            "description": "Display faillog record or maintains failure counters and limits (if used with -l, -m or -r options) only for the specified user(s). The users can be specified by a login name, a numerical user ID, or a RANGE of users. This RANGE of users can be specified with a min and max values (UIDMIN-UIDMAX), a max value (-UIDMAX), or a min value (UIDMIN-). When none of the -l, -m, or -r options are used, faillog displays the faillog record of the specified user(s)."
        }
    ],
    "examples": [],
    "see_also": [
        {
            "name": "login",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/login/1/json"
        }
    ]
}