7

I'm looking for logs on attempts by someone to access one of my Macs on a previous day. I have remote management running and I allow VNC access. In the logs I have found, I see the attempts they made, but there's no IP address logged. Where can I see this?

An example of a console log I have is "system.log.0" (backed up the last day). I have tons of these log events from when someone was connected:

(com.apple.screensharing[2323232]): Endpoint has been activated through legacy launch (3) API's

There is no other logged info.

Also, I don't have a "secure.log" file.

I just want to know what IPs were connected to my Mac during a specific time frame. Is there any other log or source of info in macOS Sierra I could harvest for this?

|improve this question
  • I'm not sure if you've found any solutions, but I've began combing through this mac4n6.com/blog/2016/11/13/… but haven't had the time to figure out how to log / monitor VNC connections – Gi0rgi0s Jun 19 '17 at 15:44
2

Beginning with macOS Sierra, there is a new unified logging system, which requires a bit more work to access than the old system.log, but includes far more details.

Use this command to show the last three days of access logs: log show --last 3d --predicate 'processImagePath CONTAINS "screensharingd" AND eventMessage CONTAINS "Authentication"'

This will show timestamps, IP, username, and authentication failure/success for both VNC and Apple Screen Sharing connections.

|improve this answer
  • This is great...thanks for sharing the command. How can we make it persistent and have it log this in Console? Is there another log maintaining this I can't see? – user237413 Jun 5 '18 at 8:23
  • What do you mean by persistent? The console app is nearly useless in Sierra. To show in real-time you can use log stream instead. – Elliott Jun 6 '18 at 7:02
  • More info about Console: eclecticlight.co/2016/09/23/… – Elliott Jun 6 '18 at 7:08
  • I mean see a backfilled log the console keeps. I want to see log records in the console – user237413 Jun 7 '18 at 11:29
  • 1
    @Kevin I'm not aware of any way to remove entries. The files are tracev3 compressed binary format in /var/db/diagnostics so you could delete the whole thing. – Elliott Jun 9 at 18:50

You must log in to answer this question.