Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I want to see if somebody has tried to log in on my computer, which is running Mavericks.

I have seen the Q&A's

but I do not have the file /var/log/secure.log on Mavericks. Is there an analogue for this file?


I have seen How to log login and logout on Mavericks?, but last seems to list only successful logins, or at least it mostly shows successful logins.


I have also seen an answer about looking in system.log or "all messages", using the console utility. Those files/messages seem very cluttered. I suppose I could make a script to go through them, but hopefully there is an easier way and admittedly it is not super important to me.

share|improve this question
    
Are you looking to track ssh log in, local console log in, screen sharing log in, opening terminal? What does "log in" mean and are you looking for any solution or just one that is scriptable from a shell? –  bmike Feb 11 at 18:01
    
@bmike I do not know what a screen sharing log in is. I am interested in the first two options, shh and local console. A while back my account on a friends server was hacked, as the credentials we made up were silly and we had enabled ssh. Fortunately no damage was dealt. I was wondering if such attacks could be found in a log, but I am also interested in people physically typing passwords on my keyboard to try to log in. –  Jacob Akkerboom Feb 11 at 18:24
    
Excellent refinement on the question. I've been meaning to ask how to set up a ssh trigger to prevent repeated log in attempts. The answers here might give me some ideas on how to implement that sort of automated protection. –  bmike Feb 11 at 18:27

1 Answer 1

up vote 5 down vote accepted

You can use this Terminal command:

cat /private/var/log/system.log | grep "Failed to authenticate"
Feb 11 16:48:04 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
Feb 11 16:48:06 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
share|improve this answer
    
+1. Unfortunately system.log only contains only entries from Feb 11. –  Jacob Akkerboom Feb 11 at 18:27
3  
Something like zgrep "whatever" /path/to/system.log* with some processing would check all compressed logs that remain on the system. I wonder if there's a way to call the apple system logger to get a more flat view of multiple log file's worth contents. –  bmike Feb 11 at 18:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.