Originally posted by: YanivM3

Hello 

which file inform that the user is locked ? i want   to send it to a remote syslog server 

Thanks 

Originally posted by: AncientAIXer

The /etc/security/user file has that info, but that is not all you have to check.  To check this I usually use the lsuser command:

lsuser -a account_locked,unsuccessful_login_count ALL

If you want it to go to syslog, put it in a loop, check for various conditions, and output to syslog.