Login attempt failed reset after success

hello all,

greetings...

I`ve config for /etc/pam.d/sshd:
auth required pam_sepermit.so
auth required pam_tally2.so deny=3 onerr=fail

and /etc/pam.d/system-auth:
account required pam_unix.so broken_shadow
account required pam_tally2 per_user deny=3 magic_root reset

but after changes config Iam not able using su - even password was failed always show like:
su: incorrect password

how to config login attempt failed 2 times but when 3 time success failure reset to 0
[root@localhost pam.d]# /sbin/pam_tally2 -u root
Login Failures Latest failure From
root 2

3 times login success

[root@localhost pam.d]# /sbin/pam_tally2 -u root
Login Failures Latest failure From
root 0

please help

thanks
newbie