I have found some answers on here but need to check something. Is there a way to check the failed login attempts form previous days?

I have tried:


but that only gives me results for the current day and I need them for the past 4 days ideally.

Have also used

cat /private/var/log/system.log | grep "Failed to authenticate"

And again only todays results.

Thanks in advance!

1 Answer 1


As the logs is rotating, you could find the info you need on previos files. After some predefined size, the logs files are moved and compressed. See example image.

enter image description here

So, you have to look after files that suits your dates requirements and uncompress it using gunzip filename.gz command.

Then you can grep your pattern on those files.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .