I would need to configure SLES 11 SP3 to log bad login attemps from GUI login screen (KDE). I created file "/var/log/btmp" with touch and set correct permissions. Problem is that with "lastb" command I can see only bad login from ssh in a form :
username ssh:notty localhost/IP date time
in manual pages to last command it is stated that:
"lastb Same as last, except that by default it shows a log of the file /var/log/btmp, which contains all the bad login attempts."
Audit works fine for me but if it is possible I would need to use lastb and btmp file..