15

In Mac OS X, if I don't touch it for a while, it will lock the screen and one must use password to unlock it, but this kind of log in is not recorded by last command. I want to know if anybody tried to break into my MacBook when I am not in front of it. Is there any way I can log such attempts?

  • Do you want to know if someone guessed your password and fot in? Or merely tried? – boehj Jun 1 '11 at 5:44
  • @boehj I want to know if anyone tried to log in my macbook, no matter he got the right password or a log in failure. – Dwayne Jun 1 '11 at 6:47
11

If you suspect that someone has correctly guessed your password and got in, you can check this via the Console. To access Console press ⌘+space and type 'console' in the Spotlight box that appears. Click return.

Click on 'Diagnostic and Usage Messages' on the left panel. At the time of the correct login attempt you see something like this:

Console

Note: 'screen locked, user typed correct password'.

Now if someone tried, yet failed, you'd see something like this under system.log (also accessible via Console):

fail

I hope that's of some assistance to you.

  • It should be control + space to open Spotlight, maybe it is because I am not using English version?But this is surely what I want, thx a lot! – Dwayne Jun 1 '11 at 6:53
  • No, you're probably right. I think I've configured it so I can just hit them together easily. Good luck with the detective work. – boehj Jun 1 '11 at 7:13
  • just search loginwindow in search box. – Dwayne Jun 1 '11 at 12:11
  • @user465191: Yeh that's right. There are a couple of ways of getting to the info you want. It's also probably worth noting here that such error messages will be thrown if someone is trying to get at your machine over a network (i.e. they don't need physical access to your MacBook). – boehj Jun 1 '11 at 12:28
  • 1
    Don't mean to necro, just wanted to add I don't see these logs in Diagnostic and Usage Messages. But I was just browsing around for something similar and noticed under Files -> secure.log it keeps track of loginwindow-related stuff. I was just looking for this kind of thing to figure out approximately when I came into work to log hours so it's good enough for me. Maybe it'll help others. Thanks! – notacouch Dec 5 '12 at 15:21
10

OSX 10.10.3

1.open the Console

2.Expand the /var/log/ on the left panel

3.Click on accountpolicy.log

You'll see something like AuthenticationAllowed completed: record "xx", result: Success (0)..

It seems like this log record all the login history,include failing ones.

How to differentiate it? Success ones have two lines, when failing ones have only one line, I guess ;-)

  • Thank you, this was exactly the file I was searching for for my simple statistics :) #gzcat accountpolicy.log.* | awk '{print $8}' | sort | uniq -c | sort -n – Daywalker Sep 22 '15 at 18:24
  • I didn't see an "accountpolicy.log" on my console. I was able to see when the display is turned on via "/var/log (expand tree) -> powermanagement -> today.asl" phew! :) – rogerdpack Sep 26 '18 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.