7

I am able to see the failed login attempts made on High Sierra via the command:

log show --predicate '(eventMessage CONTAINS "Authentication failed")' --style syslog --last 1h

However it does not tell which user did the attempt fail for. Is there a way for system admin to see the username as well for the failed and successful login attempts ?

By Login I mean local login from the Lock screen or upon system reboot.

The command to retrieve logs for failed attempts was from this question:

How do I see all my failed login attempts (macOS High Sierra)

But the answers to that question stopped short of telling how to see username of failed attempt in logs.

Is it possible to see the username for failed and successful attempts?

Improve this question
1
  • When I use that command on Mojave, I get log: Could not open local log store: The log archive format is corrupt and cannot be read. I don't know if this is a problem with my system or if the command has changed. Anyways - I understand that login names are not stored in the logs. I just entered my password in the username field and obviously don't want that to show up in the logs even if I'm the only user on this system.
    – SPRBRN
    Commented Feb 2, 2019 at 23:06

1 Answer 1

Reset to default
6

After reaching out to Apple and not getting the answer, I was finally able to find the answer to this. To see the redacted information i.e. one that is marked as '< private >' I needed to turn on private mode. Here is the command to do that:

sudo log config --mode "private_data:on"

Now you can lock your screen and log back in and from now on the logs will show all the information that was earlier redacted and marked ''.

Hope this helps someone else looking for the answer.

Improve this answer
3
  • This does not work with 10.15.1 (Catalina)
    – DavidA
    Commented Nov 5, 2019 at 11:51
  • I got log: Invalid Modes 'private_data:on' on 10.15.4
    – Ted
    Commented Apr 15, 2020 at 10:19
  • I have not upgraded to Catalina yet, so cannot look into it. It'll be a while before I do because my MS Office 2011 (32 bit) will stop working on Catalina and I don't want to spend more money buying office again.
    – Curious101
    Commented Apr 15, 2020 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .