How can I see logs of failed login attempts in MacOS Sequoia?
Some background... **queue cheesy soap opera music**
My brother's soon-to-be-ex-wife is proving to be a bit of a terror since he filed for divorce. My brother is a bit of a luddite and he failed to reset one of his old iPhones. She managed to get her hands on it and has been monitoring his emails and text messages with family, his lawyer, private investigator etc. He has since confiscated the old phone and I've helped him to reset his passwords etc and lock down his digital life. In the meantime we think she's still trying to get access to his devices any time he leaves the house and we're trying to get some evidence of that. In that vein I'm trying to get a record of failed login attempts to his iMac w/timestamps that correspond to him being out of the house. None of this will likely be usable in court, but useful info for his attorney all the same and could be useful if we hand devices over for any official forensic work down the road.
Anyway, I've come across several posts online detailing how I can see failed MacOS login attempts in system logs. The following is the most common...
log show --predicate '(eventMessage CONTAINS "Authentication failed")' --style syslog --last 1h
When I run this on my private laptop it's VERY slow and gives me a lot of results. Since I almost never forget my personal login I know these results have nothing to do with failed system logins. As I understand it Apple has recently restructured how system logs work as well so maybe there is a different approach in Sequoia?
Anyway, any help would be appreciated!
