Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.
Sign up to join this community
I want to see if somebody has tried to log in on my computer, which is running Yosemite. I am primarily interested in tracking ssh log in attempts, as well as tracking people physically typing passwords on my keyboard to try to log in.
Closely related
sshd logging is determined in /etc/asl/com.openssh.sshd.
In short, you need to touch a file and then send syslogd a HUP signal:
touch /var/run/com.openssh.sshd-asl-enabled
kill -HUP $(ps -ef | grep [s]yslogd | awk '{print $2}')
After that, you will find the logs in /var/log/sshd.log
This answer is based on this one, but that answer does not list ssh attempts on Yosemite
Here is a start
grep "authentication error for" /private/var/log/system.log
This probably lists all failed login attempts via ssh. The answer in the linked answer still works; you can use
grep "Failed to authenticate user" /private/var/log/system.log
to see failed local login attempts. This does not include login attempts from a terminal window. It does include failed attempts to "switch user".
