pam.d/system-auth and faillog - FC 4

[Martin Corona <webwarrior@xxxxxxxxxx>]

I can't seem to lock out users or see
any faillog output.

I did the following

touch /var/log/faillog
chmod 644 /var/log/faillog (so I don't
have to be root to see it)

Here is my system-auth config

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the
next time authconfig is run.
auth        required
     /lib/security/$ISA/pam_env.so
auth        required
     /lib/security/$ISA/pam_tally.so  no_magic_root
auth        sufficient
   /lib/security/$ISA/pam_unix.so likeauth nullok
auth        required
     /lib/security/$ISA/pam_deny.so
account     required  
   /lib/security/$ISA/pam_unix.so
account     required  
   /lib/security/$ISA/pam_tally.so per_user deny=5 no_magic_root
reset
account     sufficient  
 /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     required  
   /lib/security/$ISA/pam_permit.so
password    requisite  
  /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient  
 /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow
password    required  
   /lib/security/$ISA/pam_deny.so
session     required  
   /lib/security/$ISA/pam_limits.so
session     required  
   /lib/security/$ISA/pam_unix.so



But here is my faillog output - I tried
to log in with a bogus password hoping I would see something.

[root@ibmsql-1 ~]# faillog
[root@ibmsql-1 ~]#

NADA, ZIP, ZILCH

What am I missing?