How to know when and which user logged into the system under Mac OS X? Last is not enough!

If you suspect that someone has correctly guessed your password and got in, you can check this via the Console. To access Console press ⌘+space and type 'console' in the Spotlight box that appears. Click return.

Click on 'Diagnostic and Usage Messages' on the left panel. At the time of the correct login attempt you see something like this:

Note: 'screen locked, user typed correct password'.

Now if someone tried, yet failed, you'd see something like this under system.log (also accessible via Console):

I hope that's of some assistance to you.

OSX 10.10.3

1.open the Console

2.Expand the /var/log/ on the left panel

3.Click on accountpolicy.log

You'll see something like AuthenticationAllowed completed: record "xx", result: Success (0)..

It seems like this log record all the login history,include failing ones.

How to differentiate it? Success ones have two lines, when failing ones have only one line, I guess ;-)