List failed login attempts on Mavericks
I want to see if somebody has tried to log in on my computer, which is running Mavericks. I am primarily interested in tracking ssh log in attempts, as well as tracking people physically typing passwords on my keyboard to try to log in.
Related
I have seen How to log login and logout on Mavericks?, but last
seems to list only successful logins, or at least it mostly shows successful logins.
I have also seen an answer about looking in system.log or "all messages", using the console utility, but those files/messages seem very cluttered.
Related Q&As for older OSX versions
- How do I detect failed remote login attempts and block them?
- Where do I find the logs for OS X authentication attempts?
You can use this Terminal command:
cat /private/var/log/system.log | grep "Failed to authenticate"
Feb 11 16:48:04 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
Feb 11 16:48:06 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).