I'm fairly new to Mac and have owned my Mini for about 6 months, running Yosemite 10.10.5. I'm a bit more paranoid than the average user, for legit reasons I won't bore everyone with. I would like to see if someone is accessing my system while I'm away - either remotely or physically. I thought login attempts were logged in the Syslog, but I just checked and it seems they are not. Because of programs I need to run in the background, I lock my system when I'm away and do not fully logout or shutdown (I have a shortcut set to start the password-locked screensaver when mouse goes to upper left). I just now locked and unlocked, first trying several incorrect passwords (to see what happens in the syslog). The following was the only new info this triggered in the syslog. Is there a way to activate more complete syslog info for screensaver unlocks? I also ran a "last" command from Terminal, with results below as well. This showed only my actual logins/logouts - which is only about 15 actual account logins since I got it (the one "guest" was myself testing to see what a guest user had access to, prior to disabling guest). And the bonus question... is there a program I can install that will email me anytime someone unlocks my system/logs in?
Many thanks,
Tim
SYSLOG:
9/15/15 7:05:14.920 AM ScreenSaverEngine[29284]: ### archList
16777223
) --- 0
9/15/15 7:05:14.971 AM ScreenSaverEngine[29284]: ### archList
16777223
) --- 0
9/15/15 7:05:15.026 AM launchservicesd[76]: Application App:"loginwindow" asn:0x0-1001 pid:92 refs=7 @ 0x7fe67a503a30 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0xd5ad5a pid=29284 "ScreenSaverEngine"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue
9/15/15 7:05:15.026 AM WindowServer[184]: [cps/setfront] Failed setting the front application to loginwindow, psn 0x0-0x1001, securitySessionID=0x186a6, err=-13066
9/15/15 7:05:15.079 AM launchservicesd[76]: Application App:"loginwindow" asn:0x0-1001 pid:92 refs=8 @ 0x7fe67a503a30 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0xd5ad5a pid=29284 "ScreenSaverEngine"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue
9/15/15 7:05:15.079 AM WindowServer[184]: [cps/setfront] Failed setting the front application to loginwindow, psn 0x0-0x1001, securitySessionID=0x186a6, err=-13066
9/15/15 7:05:25.869 AM loginwindow[92]: ERROR | -[LWBuiltInScreenLockAuthLion askForPasswordBuiltIn:] | Attempted to add an observer when already observing
LAST command results:
Tim console Wed Sep 2 08:45 still logged in
reboot ~ Wed Sep 2 08:44
Tim console Fri Aug 21 15:07 - crash (11+17:36)
reboot ~ Fri Aug 21 15:07
shutdown ~ Fri Aug 21 15:06
root console Fri Aug 21 15:04 - shutdown (00:01)
Tim console Thu Aug 6 08:54 - 15:04 (15+06:10)
reboot ~ Thu Aug 6 08:56
shutdown ~ Thu Aug 6 08:53
Tim console Mon Jul 6 11:27 - 08:53 (30+21:26)
reboot ~ Mon Jul 6 11:27
shutdown ~ Mon Jul 6 11:26
Tim console Mon Jul 6 11:15 - 11:26 (00:11)
reboot ~ Mon Jul 6 11:14
shutdown ~ Mon Jul 6 11:14
Tim console Mon Jul 6 11:03 - 11:14 (00:11)
reboot ~ Mon Jul 6 11:03
shutdown ~ Mon Jul 6 11:01
root console Mon Jul 6 10:58 - shutdown (00:02)
Tim console Thu May 7 19:45 - 10:58 (59+15:12)
reboot ~ Thu May 7 19:45
shutdown ~ Thu May 7 19:44
Guest console Thu May 7 12:35 - 12:39 (00:03)
Tim console Thu May 7 05:44 - 19:44 (14:00)
reboot ~ Thu May 7 05:44
shutdown ~ Wed May 6 17:47
Guest console Wed May 6 11:19 - 11:20 (00:00)
Tim console Fri Apr 17 08:43 - 17:47 (19+09:03)
reboot ~ Fri Apr 17 08:43
shutdown ~ Fri Apr 17 08:42
root console Fri Apr 17 08:39 - shutdown (00:03)
Tim console Fri Mar 20 10:42 - 08:39 (27+21:56)
reboot ~ Fri Mar 20 09:29
shutdown ~ Fri Mar 20 09:28
root console Fri Mar 20 09:27 - shutdown (00:00)
Tim ttys000 Fri Mar 20 08:55 - 08:55 (00:00)
Tim console Tue Mar 10 09:22 - 09:27 (10+00:05)
reboot ~ Tue Mar 10 09:21
shutdown ~ Tue Mar 10 09:21
root console Tue Mar 10 09:21 - shutdown (00:00)
Tim console Fri Mar 6 13:05 - 09:21 (3+19:15)
reboot ~ Fri Mar 6 13:05
shutdown ~ Fri Mar 6 13:04
Tim console Mon Mar 2 11:09 - 13:04 (4+01:55)
reboot ~ Mon Mar 2 11:09
shutdown ~ Mon Mar 2 11:07
root console Mon Mar 2 11:04 - shutdown (00:02)
Tim console Mon Mar 2 10:59 - 11:04 (00:04)
Tim console Mon Mar 2 08:52 - shutdown (02:14)
root console Mon Mar 2 08:43 - 08:52 (00:09)
reboot ~ Thu Feb 26 11:51
Many thanks,
Tim
SYSLOG:
9/15/15 7:05:14.920 AM ScreenSaverEngine[29284]: ### archList
16777223
) --- 0
9/15/15 7:05:14.971 AM ScreenSaverEngine[29284]: ### archList
16777223
) --- 0
9/15/15 7:05:15.026 AM launchservicesd[76]: Application App:"loginwindow" asn:0x0-1001 pid:92 refs=7 @ 0x7fe67a503a30 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0xd5ad5a pid=29284 "ScreenSaverEngine"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue
9/15/15 7:05:15.026 AM WindowServer[184]: [cps/setfront] Failed setting the front application to loginwindow, psn 0x0-0x1001, securitySessionID=0x186a6, err=-13066
9/15/15 7:05:15.079 AM launchservicesd[76]: Application App:"loginwindow" asn:0x0-1001 pid:92 refs=8 @ 0x7fe67a503a30 tried to be brought forward, but isn't in fPermittedFrontApps ( ( "LSApplication:0x0-0xd5ad5a pid=29284 "ScreenSaverEngine"")), so denying. : LASSession.cp #1521 SetFrontApplication() q=LSSession 100006/0x186a6 queue
9/15/15 7:05:15.079 AM WindowServer[184]: [cps/setfront] Failed setting the front application to loginwindow, psn 0x0-0x1001, securitySessionID=0x186a6, err=-13066
9/15/15 7:05:25.869 AM loginwindow[92]: ERROR | -[LWBuiltInScreenLockAuthLion askForPasswordBuiltIn:] | Attempted to add an observer when already observing
LAST command results:
Tim console Wed Sep 2 08:45 still logged in
reboot ~ Wed Sep 2 08:44
Tim console Fri Aug 21 15:07 - crash (11+17:36)
reboot ~ Fri Aug 21 15:07
shutdown ~ Fri Aug 21 15:06
root console Fri Aug 21 15:04 - shutdown (00:01)
Tim console Thu Aug 6 08:54 - 15:04 (15+06:10)
reboot ~ Thu Aug 6 08:56
shutdown ~ Thu Aug 6 08:53
Tim console Mon Jul 6 11:27 - 08:53 (30+21:26)
reboot ~ Mon Jul 6 11:27
shutdown ~ Mon Jul 6 11:26
Tim console Mon Jul 6 11:15 - 11:26 (00:11)
reboot ~ Mon Jul 6 11:14
shutdown ~ Mon Jul 6 11:14
Tim console Mon Jul 6 11:03 - 11:14 (00:11)
reboot ~ Mon Jul 6 11:03
shutdown ~ Mon Jul 6 11:01
root console Mon Jul 6 10:58 - shutdown (00:02)
Tim console Thu May 7 19:45 - 10:58 (59+15:12)
reboot ~ Thu May 7 19:45
shutdown ~ Thu May 7 19:44
Guest console Thu May 7 12:35 - 12:39 (00:03)
Tim console Thu May 7 05:44 - 19:44 (14:00)
reboot ~ Thu May 7 05:44
shutdown ~ Wed May 6 17:47
Guest console Wed May 6 11:19 - 11:20 (00:00)
Tim console Fri Apr 17 08:43 - 17:47 (19+09:03)
reboot ~ Fri Apr 17 08:43
shutdown ~ Fri Apr 17 08:42
root console Fri Apr 17 08:39 - shutdown (00:03)
Tim console Fri Mar 20 10:42 - 08:39 (27+21:56)
reboot ~ Fri Mar 20 09:29
shutdown ~ Fri Mar 20 09:28
root console Fri Mar 20 09:27 - shutdown (00:00)
Tim ttys000 Fri Mar 20 08:55 - 08:55 (00:00)
Tim console Tue Mar 10 09:22 - 09:27 (10+00:05)
reboot ~ Tue Mar 10 09:21
shutdown ~ Tue Mar 10 09:21
root console Tue Mar 10 09:21 - shutdown (00:00)
Tim console Fri Mar 6 13:05 - 09:21 (3+19:15)
reboot ~ Fri Mar 6 13:05
shutdown ~ Fri Mar 6 13:04
Tim console Mon Mar 2 11:09 - 13:04 (4+01:55)
reboot ~ Mon Mar 2 11:09
shutdown ~ Mon Mar 2 11:07
root console Mon Mar 2 11:04 - shutdown (00:02)
Tim console Mon Mar 2 10:59 - 11:04 (00:04)
Tim console Mon Mar 2 08:52 - shutdown (02:14)
root console Mon Mar 2 08:43 - 08:52 (00:09)
reboot ~ Thu Feb 26 11:51
