I've tried the following commands:
syslog -F raw -k Facility com.apple.system.lastlog | grep <my_username>
cat /var/log/asl.log (DOES NOT WORK ON HighSierra)
who
Thanks to Scot, the following command works:
log show --predicate '(eventMessage CONTAINS "Authentication failed")' --style syslog --last 1d
The problem with this is that it does not give me the username of the account trying to be accessed.
Does anyone of any bash/Python programs or Terminal commands that will give me my failed login attempts (graphical login/ssh)?
See more info here
Best Answer
I wanted to see Username of the failed and successful login attempts on my Mac High Sierra and ended up posting another question on SE. Later I found the answer and updated that post.
If you're still looking for a way to see usernames in logs then you need to turn on "private" mode for logs. Here is the command to do that:
Here is my post where I've posted this answer already:
Mac OS High Sierra how to see Username for the failed login attempt