Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got my firewall on (the OS X firewall) and I've got a lot of attempts on screen sharing.

Allow AppleVNCServer connecting from uid = 0 proto=6

I want to log successful connections to make sure no one is making it through, similar to what is done with /var/log/secure.log

In fact, I'm surprised this isn't included with secure.log

What can I do?

For what its worth, I am running Mac OS X 10.5.8.

Update 1:

Daniel had a nice suggestion to use

netstat -a | grep vnc | grep ESTABLISHED

redirected to a file to log what is going on.

The problem is a connection is flagged as ESTABLISHED as soon as the vnc login screen comes up regardless of whether or not a login is ultimately successful.

In other words, all those (hopefully) failed attempts that my firewall logs will look no different than my successful logins.

share|improve this question
I agree the secure log in 10.5.8 does log VNC attempts, but says either FAILED or SUCCEEDED – user55436 Aug 20 '13 at 3:03

You can very easily extend the script that was suggested to me in another question to solve my need for notifications when VNC connections were established.

Basically, replace the notification aspect of the script with a line that writes to a log file.

share|improve this answer
This is a nice suggestion but doesn't quit discriminate between successful attempts and failed attempts. Take a look at my update above. – emiller Jun 20 '11 at 3:41

Screen shares are logged in /var/log/secure.log

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.