Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #75290
| From | Alan Baker <email@domain.com> |
|---|---|
| Newsgroups | comp.sys.mac.system |
| Subject | Re: Viewing login failures under OS X |
| Date | 2015-05-10 11:10 -0700 |
| Organization | Datemas.de http://www.news.datemas.de |
| Message-ID | <mio6vi$4sp$1@news.datemas.de> (permalink) |
| References | <miejjt$e7p$1@news.albasani.net> <mieks1$ed3$1@news.datemas.de> <mihb4o$j29$1@news.albasani.net> <554c3212$0$57781$c3e8da3$c8b7d2e6@news.astraweb.com> |
On 2015-05-08 03:48:34 +0000, JF Mezei said: > On 15-05-07 23:39, User Bp wrote: > >> Nothing referring to ssh or sftp, so I guess all is good. The date >> given is about the time I upgraded some software, >> but there didn't seem to be any problem with the upgrade. > > Try to login with wrong password at a specific known time and then > search the logs for it. > > > the file /etc/syslog.conf can give you hints on which messages go to > which files, and you can then do greps on those files. With later versions of the OS, most messages end up in the Spotlight searchable "All messages" (in fact, you can set up a permanent query for it: "sender contains authorizationhost", and I did precisely what you said: 5/6/15 8:04:19.433 PM authorizationhost[26050]: Failed to authenticate user <usernameRedacted> (error: 9). That won't catch ssh logins, but you can set up a query that looks for: [ sender = "authorizationhost" OR sender = "sshd" ] And that will cover both cases. :-)
Back to comp.sys.mac.system | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Viewing login failures under OS X User Bp <bp@www.zefox.net> - 2015-05-07 02:45 +0000
Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-06 20:06 -0700
Re: Viewing login failures under OS X User Bp <bp@www.zefox.net> - 2015-05-08 03:39 +0000
Re: Viewing login failures under OS X JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-05-07 23:48 -0400
Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-10 11:10 -0700
Re: Viewing login failures under OS X awoolmeyer@gmail.com - 2015-05-12 11:46 -0700
Re: Viewing login failures under OS X Alan Baker <email@domain.com> - 2015-05-12 11:48 -0700
Re: Viewing login failures under OS X David Ritz <dritz@mindspring.com> - 2015-05-07 11:44 -0500
csiph-web