Where can I find logs for failed sudo attempts on macOS Sierra?
The sudo logs now go to the new unified logging system in macOS 10.12, which can be searched using the log command.
For example, to show all sudo logs from the last 3 hours:
log show --style syslog --predicate 'process == "sudo"' --last 3h
To search all sudo logs for messages containing the string "user NOT in sudoers":
log show --style syslog --predicate 'process == "sudo" and eventMessage contains "user NOT in sudoers"'
Use man log or log help show to learn more about how to use the command.