Not trusting anyone, not even my own firewalls and other measures against invasive hackers, I like to be able to monitor any successful login to my OS X systems (e.g. by instantly sending an email to my gmail account).

How do I accomplish this, including logins via Screen Sharing and SSH?

I can see that the secure.log file lists such logins, but how do I monitor them, and filter them for successful logins, in order to issue emails about these events?

User bmike suggested using the tail command on the secure.log file. I found that this command has an option "-F" that is well suited for this task: I keeps reporting added lines to the log file, and even handles log file rotations.

But this is not sufficient for my needs yet. I only want to send out the notifications if an external access (login) occured, not every time a local task is getting authorized.

Here's an excerpt from my secure.log file:

mymac login[26292]: in pam_sm_acct_mgmt(): OpenDirectory - Membership cache TTL set to 1800.
mymac login[26292]: in od_record_check_pwpolicy(): retval: 0
mymac login[26292]: in od_record_attribute_create_cfstring(): returned 3 attributes for dsAttrTypeStandard:AuthenticationAuthority
mymac sudo[26296]:    myname : 3 incorrect password attempts ; TTY=ttys005 ; PWD=/Users/myname ; USER=root ; COMMAND=/bin/bash
mymac sudo[26301]:    myname : TTY=ttys005 ; PWD=/Users/myname ; USER=root ; COMMAND=/bin/bash
mymac com.apple.SecurityServer[27]: Succeeded authorizing right 'system.hdd.smart' by client '/Library/Application Support/iStat local/iStatLocalDaemon' [133] for authorization created by '/Library/Application Support/iStat local/iStatLocalDaemon' [133]
mymac sshd[26308]: Accepted publickey for myname from x.x.x.x port 62433 ssh2
mymac screensharingd[26328]: Authentication: SUCCEEDED :: User Name: John Doe :: Viewer Address: x.x.x.x :: Type: DH

Only the "screensharingd" and "sshd" ones are relevant to me in this example. But there seems to be no clear distinction between these and the other local authorizations. The only common pattern I find is the IP address, but is that fail-safe? I guess to make my script generally useable (by anyone), I'd have to not only detect IPv4 addresses but also IPv6 addresses. And can I be sure that other external types of logins (e.g. file sharing) will also list a IP address in their raw format like this? Not ever using symbolic names that I wouldn't be able to detect with this pattern?

Actually, I also logged in via File Sharing (AFP) - that didn't even get listed in secure.log, oddly! Which means that secure.log is probably not the only or not the central point of learning about authorizations.

I had hoped that there's some central point in OSX that takes care of all username/password authorizations and that this point would also provide some hook for monitoring.

I am afraid my question can't be answered sufficiently in a generic way. I'll go now and ask on Apple's security mailing list. I'll report back.


My reasoning for this kind of question is that I think that no system is safe from break-in. Therefore, relying on measures to prevent a break-in are not a safe measure alone. Adding (external) notifications about when a login into a system happens is what makes it much better controllable: If someone manages to break in, he'll be detected by this method, and so the system is then known not to be trusted any more and will be dealt with. Without this kind of monitoring, someone might be able to break in and then modify the system to a point where someone looking later won't be able to tell what happened, assuming the system is still safe.


Yes - it would be more efficient to tail -f the log file so that your script only has to parse each line in the file once rather an once per interval.

Of course, you then still need to write and test the code to monitor for times when the logfile gets rotated and perhaps double check at you didn't miss an event by scanning the entire new file once when you first attach to that file.

What is best is a trade off between your comfort level and your skills. It MIT also make sense to sniff the network traffic since screen sharing listens on known ports, or you could monitor for new processes listening on new ports or you could turn on process auditing and monitor those logs or you could parse the process table. There are many ways to skin this cat.

  • Exactly, having to deal with rotating logs means I have to keep my own record of what I saw last to figure out what's been added. And it still requires polling, which I find rather inefficient. I'd think that there's some smarter way. There must be some notification system for this kind of stuff in Unix, isn't there? – Thomas Tempelmann Feb 13 '13 at 18:28
  • Using tail isn't polling, if by polling you assume it to mean checking at intervals (which I think you do). Using a process that runs in the background and tails the log file will result in instantaneous reporting once the grep/sed/awk/search conditions are matched, and thus as per your requirements the reporting will have taken place before the script can be stopped/amended. – stuffe Feb 13 '13 at 18:45
  • Well, technically it is polling because one keeps looking for changes in intervals. What I am looking for is a notification system. If that doesn't exist in OSX or Unix, then that's fine, but so far no one has said so. – Thomas Tempelmann Feb 13 '13 at 18:49
  • Then your question might need more clarity, @bmike and I both read it to mean you needed help in capturing the action in a way that wasn't an interval led poll script. This comment suggests that you are fine with that, but need help performing the notification action (a simple pipe of your script to a command line mail program like mailx for example would work). For clarity, there is no interval in monitoring a logfile via tail, it's instantaneous, it's live monitoring, not polling. – stuffe Feb 13 '13 at 18:55
  • Oh, now I get it! "tail" has a "-F" option which can even detect log rotations! How was I supposed to know? I'm a systems programmer, not a shell user! ;) But if bmike had thought of the "-F" option, why did he write that I'd still need to handle log rotation, because it appears I don't. Am I missing something? – Thomas Tempelmann Feb 13 '13 at 19:26

If you have already worked out how to mine the information from the log, then a simple way of getting it to run only when required rather than polling it every day/hour etc is to add the script as a login action to the users in question. Get them to interpret the logs, work out if it's a local or remote login, and email (or imessage etc) appropriately.

  • Polling in long intervals such as hours is not "safe", because if someone hacks into my system, then he could stop my script before it could notify me. – Thomas Tempelmann Feb 13 '13 at 18:27
  • That's why I suggest running it as a login action, and not polling - then it's run and completed before the user can amend the process. – stuffe Feb 13 '13 at 18:36
  • a login action? Do you mean a program running in the Login Items in the System Preferences? That's not working at all. Neither for ssh-logins nor for Screen Sharing. If you don't mean that, please be more clear what you mean. – Thomas Tempelmann Feb 13 '13 at 18:44
  • That's what I mean, if it's not working are you sure that the relevant permissions and such are set correctly etc? Is it working on a local login, or just failing on remote ones? – stuffe Feb 13 '13 at 18:47
  • Can I respectfully ask you to tone down your aggressive attitude. We are trying to help. There is a world of difference between a login item "not working at all" and "doesn't ever work anyway". If you do not like my answer, vote it down. – stuffe Feb 13 '13 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .