An administrator is analyzing a Linux server which was recently hacked. Which of the following will the administrator use to find all unsuccessful login attempts?

`nsswitch` refers to the `nsswitch.conf` file, which configures the order of name service lookups, not for reporting login attempts.

`faillock` (or `pam_faillock`) is a PAM module that locks user accounts after a certain number of failed attempts; while it tracks failures, `pam_tally2` is the command-line tool for auditing these counts.

The `pam_tally2` utility is specifically designed to query and reset the count of failed authentication attempts for individual users, providing the administrator with a clear record of unsuccessful login attempts.

`passwd` is a command used to change user passwords and related account information, not for finding or reporting unsuccessful login attempts.