View Last failed login attempts
This command will show you the list of last failed login attempts :
last -f /var/log/btmp
This file can get huge, so you might want to rotate this file :
/var/log/btmp {
monthly
minsize 1M
create 0600 root utmp
rotate 1
}
You can put this in logrotate.conf or you can create a separate file under /etc/logrotate.d/wtmp