Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'What logs to check' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
What logs to check
Authored by: MattHaffner on Aug 19, '05 01:08:45PM
Here's a quick terminal script to pull out the failed tries:

grep 'failed to authenticate' /var/log/secure.log

For example, I have an attempt that happened a few days ago and part of it looks like this:

Aug 16 20:45:54 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user exiot.
Aug 16 20:45:58 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user read.
Aug 16 20:46:07 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user write.
Aug 16 20:46:11 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user root.
Aug 16 20:46:15 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user shell.
Aug 16 20:46:19 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user shell.
Aug 16 20:46:23 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user shell.
Aug 16 20:46:27 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user buffer.
Aug 16 20:46:31 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user firebird.
Aug 16 20:46:35 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user amd.
Aug 16 20:46:38 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user xp.
Aug 16 20:46:42 Tyranena com.apple.SecurityServer: authinternal failed to authenticate user service.


[ Reply to This | # ]
What logs to check
Authored by: Aet on Aug 20, '05 10:25:02AM

Same problem with permissions as noted above, but a sudo fixes that.



[ Reply to This | # ]