That's not a bad sign then. Mine shows lots of attempts. lastb shows the last unsuccessful (bad) login attempts. it uses the file /var/log/btmp as input. the time stamp of "btmp begins .." either is the same as the creation date of the btmp file or if the btmp file was rotate of an older version i.e. /var/log/btmp.0