#!/bin/sh
#
# AIX
# Get which IP addr use COUNT "elapusr" enter wrong password.

while [ true ]; do

    lsuser -f elapusr | grep -q "unsuccessful_login_count=1"
    rc=$?

    if [ $rc -eq 0 ] ; then
        lsuser -f elapusr >> got_bad_user.txt
        exit
    fi

    sleep 60

done