In message <m23d8x19cv.fsf@boreas.yi.org.> so spake John Fremlin (vii): > Why does src/usr.bin/login/login.c record a login failure to syslog on > SIGHUP? It does not on SIGALRM. Because if you, e.g. telnet to a machine and close the remote end login(1) gets a SIGHUP. Therefore it needs to record a login failure just as if the user had entered ^D. - todd