I am able to see the failed login attempts made on High Sierra via the command:
log show --predicate '(eventMessage CONTAINS "Authentication failed")' --style syslog --last 1h
However it does not tell which user did the attempt fail for. Is there a way for system admin to see the username as well for the failed and successful login attempts ?
By Login I mean local login from the Lock screen or upon system reboot.
The command to retrieve logs for failed attempts was from this question:
But the answers to that question stopped short of telling how to see username of failed attempt in logs.
Is it possible to see the username for failed and successful attempts?