Logging failures to /var/log/faillog seems very non-systemd to me, shouldn't those messages go to the journal?