diff --git a/loginrec.c b/loginrec.c
index 7d1c9dd43de9..b0c54ad088ab 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -651,6 +651,9 @@ construct_utmp(struct logininfo *li,
 # ifdef HAVE_TYPE_IN_UTMP
 	/* This is done here to keep utmp constants out of struct logininfo */
 	switch (li->type) {
+	case LTYPE_FAILED:
+		ut->ut_type = LOGIN_PROCESS;
+		break;
 	case LTYPE_LOGIN:
 		ut->ut_type = USER_PROCESS;
 		break;
@@ -1732,7 +1735,7 @@ record_failed_login(struct ssh *ssh, const char *username, const char *hostname,
 
 	/* Construct a logininfo and turn it into a utmp */
 	memset(&li, 0, sizeof(li));
-	li.type = LTYPE_LOGIN;
+	li.type = LTYPE_FAILED;
 	li.pid = getpid();
 	strlcpy(li.line, "ssh:notty", sizeof(li.line));
 	strlcpy(li.username, username, sizeof(li.username));
diff --git a/loginrec.h b/loginrec.h
index 62ddd01d515a..42b45f040c04 100644
--- a/loginrec.h
+++ b/loginrec.h
@@ -52,6 +52,7 @@ union login_netinfo {
  */
 /* types - different to utmp.h 'type' macros */
 /* (though set to the same value as linux, openbsd and others...) */
+#define LTYPE_FAILED   6
 #define LTYPE_LOGIN    7
 #define LTYPE_LOGOUT   8