1

I want to see if somebody has tried to log in on my computer, which is running Yosemite. I am primarily interested in tracking ssh log in attempts, as well as tracking people physically typing passwords on my keyboard to try to log in.

Closely related

List failed login attempts on Mavericks

Improve this question

2 Answers 2

Reset to default
2

sshd logging is determined in /etc/asl/com.openssh.sshd.

In short, you need to touch a file and then send syslogd a HUP signal:
touch /var/run/com.openssh.sshd-asl-enabled
kill -HUP $(ps -ef | grep [s]yslogd | awk '{print $2}')

After that, you will find the logs in /var/log/sshd.log

Improve this answer
0

This answer is based on this one, but that answer does not list ssh attempts on Yosemite

Here is a start

grep "authentication error for" /private/var/log/system.log

This probably lists all failed login attempts via ssh. The answer in the linked answer still works; you can use

grep "Failed to authenticate user" /private/var/log/system.log

to see failed local login attempts. This does not include login attempts from a terminal window. It does include failed attempts to "switch user".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .