You can use this Terminal command:
cat /private/var/log/system.log | grep "Failed to authenticate"
Feb 11 16:48:04 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
Feb 11 16:48:06 g authorizationhost[15313]: Failed to authenticate user <grgarside> (error: 9).
System logs, for example, are compressed and then automatically deleted after a week. However, System Diagnostic Reports (whether it be a stall, spin, hang, crash, or panic report) shouldn't be automatically deleted. If you reset the NVRAM immediately following a kernel panic, however, the report is deleted (the NVRAM temporarily stores the report until reboot; if it's reset, the contents are erased). Short of forcibly removing the files (using Onyx, a similar app, or manually), this is the only situation I can come up with off hand as to why a report would vanish.
As a makeshift solution, however, you can save the kernel panic reports as a separate file.
- From Console's menu bar, View > Show Log List
- Select the panic report (kernel_[longstring].panic) from the "System Diagnostic Reports" drop down
- File > Save a Copy As... > save file to folder of your choice
UPDATE:
Onyx is the most likely culprit, however, the option for clearing logs/reports is located in multiple places:
- Cleaning > Logs > System Diagnostic Reports
- Automation > Cleaning > Logs, including Diagnostic Reports
Uncheck these options if they are checked.
Best Answer
The log files are rotated and eventually removed by the asl system. You can change the configuration by editing /etc/asl.conf under sudo. Start Terminal.app and issue this command:
You'll find in there a comment stating that rules for /var/log/system.log follows, the first line looks like this:
Change that to look like this:
This means that each seperate log file will be maximum 5M. Normally the asl system removes log files when either they exceed the all_max limit (before 50 megabyte, now 9999 gigabytes) or when the file is older than ttl days (before 7 days, now 99999 days).