What is the best way to log simple authentication events from Mac? I tried the table 'last' but it doesn't log success/failures and logs about 80 events per 'login'. I'm trying to look at 'user_events' but I am not sure it exists on Mac. Any guidance here?

https://www.osquery.io/schema/3.3.2#process_events is based on open BSM audit on MacOS

Thanks, I've enabled a query for selecting from user_events, but I am not getting anything back. Do you know of any particular settings that need to be modified? I've modified audit_control and am successfully getting results from process_events, just not user_events 😞

yes, in /etc/security/auditd-control should have

flags:lo,aa

Yes, already have that as am successfully logging process_events. I need to check auditd but I presume it is running, if process_events is updating

sudo praudit /dev/auditpipe

Nice, I can see those.

hmm... looking at the code, it might only be generating ssh events

Ok, thank you