How to check "lastb" in logs? (redhat)

When someone has bad password or not ssh keys. 

 egrep "Failed|Failure|$USER" /var/log/secure

[root@captainkirk ~]# egrep "Failed|Failure|$USER" /var/log/secure

Oct 23 09:29:09 captainkirk crond[30309]: pam_systemd(crond:session): Failed to create session: Message recipient disconnected from message bus without replying

Oct 23 09:29:09 captainkirk crond[30311]: pam_systemd(crond:session): Failed to create session: Message recipient disconnected from message bus without replying

Oct 23 09:29:09 captainkirk crond[30312]: pam_systemd(crond:session): Failed to create session: Message recipient disconnected from message bus without replying

Oct 23 09:49:44 captainkirk crond[31708]: pam_systemd(crond:session): Failed to create session: Connection timed out

Oct 23 10:19:29 captainkirk crond[31803]: pam_systemd(crond:session): Failed to create session: Connection timed out

Oct 23 10:19:30 captainkirk crond[31804]: pam_systemd(crond:session): Failed to create session: Connection timed out

Oct 23 10:19:32 captainkirk crond[31820]: pam_systemd(crond:session): Failed to create session: Connection timed out

Oct 24 08:55:51 captainkirk sshd[21122]: Accepted password for root from 10.9.3.97 port 33534 ssh2

Oct 24 08:55:51 captainkirk sshd[21122]: pam_unix(sshd:session): session opened for user root by (uid=0)

Oct 24 08:55:52 captainkirk sshd[21122]: pam_unix(sshd:session): session closed for user root

Oct 24 08:55:54 captainkirk unix_chkpwd[21142]: password check failed for user (root)

Oct 24 08:55:54 captainkirk sshd[21140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.9.3.97  user=root

Oct 24 08:55:54 captainkirk sshd[21140]: pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root"

Oct 24 08:55:57 captainkirk sshd[21140]: Failed password for root from 10.9.3.97 port 33546 ssh2

Oct 24 08:56:00 captainkirk sshd[21140]: Accepted password for root from 10.9.3.97 port 33546 ssh2

Oct 24 08:56:00 captainkirk sshd[21140]: pam_unix(sshd:session): session opened for user root by (uid=0)