Is there a record of who is remotely loging into a computer?

Is there a record of logins and attempted logins? I suspect that somebody is messing with my computer. This morning when I opened my MB Pro there was a password change screen on it, and all applications that were open last night when I put it to sleep were closed, suggesting that the computer was restarted. Is it possible that somebody tried to remotely log in, and how can I find it out?

MacPro, MacBook Pro, iPhone 4, iPad, Mac OS X (10.6.6)

Posted on Feb 12, 2011 4:51 AM

Reply
9 replies

Feb 12, 2011 6:28 AM in response to ajduguid

The "last" command returned only a recent log, because it says:
wtmp begins Fri Feb 11 21:35
and the next three records are:
komich console Sat Feb 12 07:21 still logged in
reboot ~ Fri Feb 11 21:35
shutdown ~ Fri Feb 11 21:35
meaning that the computer restarted last night, and there is no record of what's happened earlier. The next login after reboot was me this morning. This still remains a mystery, because I DID NOT restart the computer for several days now. Could if have restarted on its own? Why would it show change password screen with few letters typed into the "old password" field? It looks like somebody was trying to break into it. Am I being paranoid? There was nobody here physically except me.

Is there a global long-term log of what computer is doing that is not wiped out by restarts and logins and logouts?

Feb 13, 2011 1:08 PM in response to ajduguid

No, the log in record is very short on my MacPro and MB Pro with Snow Leopard machines. I have an MacBook G4 that runs OS X 10.4.11, and the "last" record on it dates back several years.
I've done some research on the web and came across a discussion:
http://www.macobserver.com/tmo/forums/viewthread/60214/#377750
which states that Apple has "depreciated" wtmp in Leopard, meaning that it no longer supposed to exist.

Nevertheless "last" returns at least logins after latest restart. Is there a setting in the OS that could be changed to make it remember the entire log? Why would Apple remove this functionality? What are the alternatives?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is there a record of who is remotely loging into a computer?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.