I want to see if somebody has tried to log in on my computer, which is running Mavericks. I am primarily interested in tracking ssh log in attempts, as well as tracking people physically typing passwords on my keyboard to try to log in.


I have seen How to log login and logout on Mavericks?, but last seems to list only successful logins, or at least it mostly shows successful logins.

I have also seen an answer about looking in system.log or "all messages", using the console utility, but those files/messages seem very cluttered.

Related Q&As for older OSX versions

  • Are you looking to track ssh log in, local console log in, screen sharing log in, opening terminal? What does "log in" mean and are you looking for any solution or just one that is scriptable from a shell?
    – bmike
    Feb 11, 2014 at 18:01
  • @bmike I do not know what a screen sharing log in is. I am interested in the first two options, shh and local console. A while back my account on a friends server was hacked, as the credentials we made up were silly and we had enabled ssh. Fortunately no damage was dealt. I was wondering if such attacks could be found in a log, but I am also interested in people physically typing passwords on my keyboard to try to log in. Feb 11, 2014 at 18:24
  • Excellent refinement on the question. I've been meaning to ask how to set up a ssh trigger to prevent repeated log in attempts. The answers here might give me some ideas on how to implement that sort of automated protection.
    – bmike
    Feb 11, 2014 at 18:27

1 Answer 1


You can use this Terminal command:

cat /private/var/log/system.log | grep "Failed to authenticate"
Feb 11 16:48:04 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
Feb 11 16:48:06 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
  • +1. Unfortunately system.log only contains only entries from Feb 11. Feb 11, 2014 at 18:27
  • 3
    Something like zgrep "whatever" /path/to/system.log* with some processing would check all compressed logs that remain on the system. I wonder if there's a way to call the apple system logger to get a more flat view of multiple log file's worth contents.
    – bmike
    Feb 11, 2014 at 18:29
  • All on Yosemite: BAD SU and incorrect password are keywords to search for for failed attempts to authenticate by su and sudo respectively. Ssh generates authentication error for in this same log file. I was not able to generate a message containing Failed to authenticate. Nov 15, 2015 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .