Where can I find failed login attempts using macOS mojave?

Question

Rnlawson90 Author

Level 1

4 points

Where can I find failed login attempts using macOS mojave?

I am trying to locate security logs for all login attempts. I am using macOS Mojave.

Posted on Apr 1, 2019 11:51 AM

Reply

Answer 1

leroydouglas

Level 10

200,262 points

Apr 1, 2019 12:57 PM in response to Rnlawson90

Rnlawson90 wrote:

I am trying to locate security logs for all login attempts. I am using macOS Mojave.

From the terminal.app supply your user name in the command line before you copy and paste:

syslog -F raw -k Facility com.apple.system.lastlog | grep <my_username>
cat /var/log/asl.log

for failed attempts, copy and paste:

log show --predicate '(eventMessage CONTAINS "Authentication failed")' --style syslog --last 1d

Reply

Answer 2

Kappy

Level 10

362,017 points

Apr 1, 2019 12:10 PM in response to Rnlawson90

You should use the Console utility in your Utilities’ folder. You will find all logs in these locations:

/Library/Logs

/Home/Library/Logs

Reply

Answer 3

leroydouglas

Level 10

200,262 points

Apr 2, 2019 10:00 AM in response to Rnlawson90

Copy and paste these command lines in their entirety,

2nd one did not wrap and is off the visible page, here the day is set to 1d

copy and pasting solves this problem:

syslog -F raw -k Facility com.apple.system.lastlog | grep <my_username>

log show --predicate '(eventMessage CONTAINS "Authentication failed")' --style syslog --last 1d

Reply

Answer 4

Rnlawson90 Author

Level 1

4 points

Apr 2, 2019 7:02 AM in response to leroydouglas

So I am not entirely sure I am typing the syslog line in correctly but this is what I get when I do type it in:

Rickys-MacBook-Pro:~ rickylawson$ syslog -F raw -k Facility com.apple.system.lastlog | grep RickyLawson

NOTE: Most system logs have moved to a new logging system. See log(1) for more information.

Rickys-MacBook-Pro:~ rickylawson$ cat /var/log/asl.log

cat: /var/log/asl.log: No such file or directory

Reply

Answer 5

Rnlawson90 Author

Level 1

4 points

Apr 2, 2019 10:01 AM in response to leroydouglas

Thank you....that worked for the most part.....I locked my computer screen and intentionally used an incorrect password to unlock and reran the commands and this is all I get:

2019-04-02 12:13:29.211068-0400 localhost opendirectoryd[88]: (PlistFile) [com.apple.opendirectoryd:auth] Authentication failed for <private> with ODErrorCredentialsInvalid

over and over

Reply

Answer 6

Rnlawson90 Author

Level 1

4 points

Apr 1, 2019 12:15 PM in response to Kappy

I have attempted to look through these logs and as of yet I am unable to identify the correct log. Thank you for the response.

Reply

Where can I find failed login attempts using macOS mojave?

Similar questions