The btmp log keeps track of failed login attempts. I have seen on a default linux setup with logrotate configured where the btmp log is left out of rotation and eventually grows out of hand. So first you want to make sure that the btmp log is rotated using logrotate with the below information.
Log Location:/var/log/btmp, /var/log/wtmp
To rotate the btmp log add the below to the logrotate.conf file located in the /etc directory. (more…)
