I'm on a personal computer, with Lion running and only a single user account on the computer. Is there a log file for authentication attempts (both for login attempts and password protected screensaver aka sleep mode)?

Mostly interested in the unsuccessful attempts. Is it possible to also see the passwords that were used to make those unsuccessful attempts?

1 Answer 1


It's found in the secure.log (the path is /var/log/secure.log) and the entries would look something like this:

authorizationhost[5917]: Failed to authenticate user <cksum> (error: 9).

It does not log password attempts (the password they tried to use), just the actual unsuccessful (or successful) login attempt.

Additionally, to focus your search exclusively for failed login attemps, open Terminal.app (found in Utilities folder) and run the following command:

sudo grep 'Failed to authenticate' /var/log/secure.log
  • note: The log does record the username attempted.
    – ocodo
    Sep 12, 2011 at 2:26
  • @slomojo, yes it does (look to the name in the <> tag above).
    – user10355
    Sep 12, 2011 at 2:27
  • So there is no way to get the password as well? What would I use in that case (some kind of keylogger)? Sep 13, 2011 at 6:15
  • 1
    Yes, you will likely need a keylogger and one that can run without requiring a user to sign in. I'm not sure exactly how they work, so I can't be of help there.
    – user10355
    Sep 13, 2011 at 7:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .