Which log file contains information about failed login attempts?

• A. /var/log/btmp
• B. /var/log/auth.log
• C. /var/log/secure
• D. /var/log/faillog

Answer: (A)

Failed login attempts are tracked in a dedicated log that records each failed attempt as an individual event, including when and from where it occurred. That specific log is /var/log/btmp, a binary file that you read with the lastb command to see the failed logins. This makes it the primary source for listing failed login activity.

Other logs play different roles: /var/log/auth.log and /var/log/secure capture authentication-related messages, including both successes and failures, so they’re broader audit trails rather than a focused record of failed attempts. /var/log/faillog stores per-user failure counts and is less useful for reviewing every failed attempt, since it doesn’t present the events as a straightforward log.

So for information about failed login attempts, /var/log/btmp is the best and most direct source.