MacOS – OS X 10.9.x failed login attempts previous days

logsmacos

I have found some answers on here but need to check something. Is there a way to check the failed login attempts form previous days?

I have tried:

var/log/secure.log

but that only gives me results for the current day and I need them for the past 4 days ideally.

Have also used

cat /private/var/log/system.log | grep "Failed to authenticate"

And again only todays results.

Thanks in advance!

Best Answer

As the logs is rotating, you could find the info you need on previos files. After some predefined size, the logs files are moved and compressed. See example image.

enter image description here

So, you have to look after files that suits your dates requirements and uncompress it using gunzip filename.gz command.

Then you can grep your pattern on those files.

Related Question