Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #75486
| Newsgroups | comp.sys.mac.system |
|---|---|
| Date | 2015-05-12 11:46 -0700 |
| References | <miejjt$e7p$1@news.albasani.net> <mieks1$ed3$1@news.datemas.de> <mihb4o$j29$1@news.albasani.net> <554c3212$0$57781$c3e8da3$c8b7d2e6@news.astraweb.com> <mio6vi$4sp$1@news.datemas.de> |
| Message-ID | <330c4bed-1b72-48e0-a663-58ddeed32207@googlegroups.com> (permalink) |
| Subject | Re: Viewing login failures under OS X |
| From | awoolmeyer@gmail.com |
On Sunday, May 10, 2015 at 2:11:01 PM UTC-4, Alan Baker wrote: > On 2015-05-08 03:48:34 +0000, JF Mezei said: > > > On 15-05-07 23:39, User Bp wrote: > > > >> Nothing referring to ssh or sftp, so I guess all is good. The date > >> given is about the time I upgraded some software, > >> but there didn't seem to be any problem with the upgrade. > > > > Try to login with wrong password at a specific known time and then > > search the logs for it. > > > > > > the file /etc/syslog.conf can give you hints on which messages go to > > which files, and you can then do greps on those files. > > With later versions of the OS, most messages end up in the Spotlight > searchable "All messages" (in fact, you can set up a permanent query > for it: "sender contains authorizationhost", and I did precisely what > you said: > > 5/6/15 8:04:19.433 PM authorizationhost[26050]: Failed to authenticate > user <usernameRedacted> (error: 9). > > That won't catch ssh logins, but you can set up a query that looks for: > > [ sender = "authorizationhost" OR sender = "sshd" ] > > And that will cover both cases. WOW!!! Windows actually copied that shit???
Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Viewing login failures under OS X User Bp <bp@www.zefox.net> - 2015-05-07 02:45 +0000
Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-06 20:06 -0700
Re: Viewing login failures under OS X User Bp <bp@www.zefox.net> - 2015-05-08 03:39 +0000
Re: Viewing login failures under OS X JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-05-07 23:48 -0400
Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-10 11:10 -0700
Re: Viewing login failures under OS X awoolmeyer@gmail.com - 2015-05-12 11:46 -0700
Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-12 11:48 -0700
Re: Viewing login failures under OS X David Ritz <dritz@mindspring.com> - 2015-05-07 11:44 -0500
csiph-web