cat /etc/pam.d/system-auth | grep faillock

{{{
auth       required                    pam_faillock.so      preauth
auth       [default=die]               pam_faillock.so      authfail
auth       required                    pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
}}}

/var/run/faillock/${username}