In Mac OS X, if I don't touch it for a while, it will lock the screen and one must use password to unlock it, but this kind of log in is not recorded by last command. I want to know if anybody tried to break into my MacBook when I am not in front of it. Is there any way I can log such attempts?
If you suspect that someone has correctly guessed your password and got in, you can check this via the
Console. To access
Console press ⌘+space and type 'console' in the Spotlight box that appears. Click return.
Click on 'Diagnostic and Usage Messages' on the left panel. At the time of the correct login attempt you see something like this:
Note: 'screen locked, user typed correct password'.
Now if someone tried, yet failed, you'd see something like this under
system.log (also accessible via
I hope that's of some assistance to you.
/var/log/ on the left panel
You'll see something like
AuthenticationAllowed completed: record "xx", result: Success (0)..
It seems like this log record all the login history,include failing ones.
How to differentiate it? Success ones have two lines, when failing ones have only one line, I guess ;-)