2

I'm using macOS Sierra and when I try to view failed login attempts, grep doesn't return any results because the keyword has probably changed or I'm looking in the wrong place. Does anyone know where/how to find these?

I've looked at similar questions but they are all out of date. The most recent post I found suggested trying these but neither produced any results.

grep "Failed to authenticate user" /var/log/system.log
grep "authentication error for" /var/log/system.log
  • Have you tested by intentionally creating a failed login attempt? – Tetsujin Jan 2 '17 at 10:11
  • I've tried that. – fatalError Feb 27 '17 at 23:27
2

I found out the keyword to look for is AuthenticationAllowed.

Here is an example of a bad login:

2017-03-27 14:58:52.616248-0500  localhost com.apple.AccountPolicyHelper[226]: (78.701.2) AuthenticationAllowed completed: record "testuser", result: Success (0).
2017-03-27 14:58:52.616578-0500  localhost opendirectoryd[78]: Verify password result: 5000
2017-03-27 14:58:52.616620-0500  localhost opendirectoryd[78]: ODRecordVerifyPassword failed with error 'Invalid credentials' (5000)

And this is a good login:

2017-03-27 15:02:33.444367-0500  localhost com.apple.AccountPolicyHelper[226]: (78.702.2) AuthenticationAllowed completed: record “otheruser", result: Success (0).
2017-03-27 15:02:33.444540-0500  localhost opendirectoryd[78]: ODRecordAuthenticationAllowed completed

You can find these by using the log show —style syslog -last 5m command. This will show the last 5 minutes of messages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .