root Users
Failed Logins

awk -F: '{if ($3 == 0) print $1}' /etc/passwd

This command searches the /etc/passwd file and lists all users with root (UID 0) authority.

who -s /etc/security/failedlogin | tail -20

This command lists the last 20 failed logins.