1

My version of i3lock is 2.7 (2015-05-20). I checked the manpage and there is -f option to show the number of failed unlocking attempts:

-f, --show-failed-attempts

         Show the number of failed attempts, if any.

It prints them on locked screen inside the unlock indicator, but I don't see any option to print it in console or output it to file. I want to get emails every time somebody tries to unlock my computer, and I need to pass every unlock failure to a script.

Are failed attempts kept in a file or are they accessible in any other way?

Improve this question

1 Answer 1

Reset to default
2

I have the same i3lock version and I see that in /var/log/auth.log are information about granted or failed authentications.

E.g.:

/var/log/auth.log:Jan 13 09:09:22 **** adclient[1565]: INFO AUDIT_TRAIL|Centrify Suite|PAM|1.0|101|PAM authentication denied|5|user=dave(type:ad,dave@dave) pid=12337 utc=1484294962044 status=DENIED service=i3lock tty=(none) client=(none) reason=Authentication failure

/var/log/auth.log:Jan 13 09:09:29 *** adclient[1565]: INFO AUDIT_TRAIL|Centrify Suite|PAM|1.0|100|PAM authentication granted|5|user=dave(type:ad,dave@dave) pid=12337 utc=1484294969896 status=GRANTED service=i3lock tty=(none) client=(none)

So I think it would be easy to create simple deamon, that search for "status=DENIED service=i3lock" in /var/log/auth.log and take some action about it.

EDIT (Answer added by Jezor):

On Manjaro (Arch) doesn't have /var/log/auth.log enabled by default. To enable logging:

journalctl SYSLOG_FACILITY=10

Logs can be found in /var/log/journal

It's tailable and failed logging with i3lock looks like:

Jan 31 22:22:37 manjarko i3lock[4135]: pam_unix(i3lock:auth): authentication failure; logname= uid=1000 euid=1000 tty=:0 ruser= rhost= user=jezor

Improve this answer
6
  • 1
    Whoah, you made my day with the notification about your answer! I didn't think anybody would review questions that are as long as this one. Thank you! I'm going to try and make something to get use of it tommorow (:
    – Jezor
    Jan 13, 2017 at 21:27
  • 1
    @Jezor I was searching for some information about i3lock and somehow I find Your question:) hope it helps:) Good luck!
    – Tyler
    Jan 31, 2017 at 11:29
  • Eh, unfortunately Manjaro (Arch) doens't have /var/log/auth.log enabled by default. After some googling I came up with journalctl SYSLOG_FACILITY=10 (from Arch wiki). It's tailable and failed logging with i3lock looks like Jan 31 22:22:37 manjarko i3lock[4135]: pam_unix(i3lock:auth): authentication failure; logname= uid=1000 euid=1000 tty=:0 ruser= rhost= user=jezor - you might want to add it to your answer (:
    – Jezor
    Jan 31, 2017 at 21:25
  • I've added Your update. Can You confirm that logs You've posted are from /var/log/auth.log or maybe other file?
    – Tyler
    Feb 3, 2017 at 6:54
  • 1
    Thanks. I've added info about log location to make answer more complete.
    – Tyler
    Feb 6, 2017 at 9:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .