Detect failed local login attempts I'm using macOS Sierra and when I try to view failed login attempts, grep doesn't return any results because the keyword has probably changed or I'm looking in the wrong place. Does anyone know where/how to find these?

I've looked at similar questions but they are all out of date. The most recent post I found suggested trying these but neither produced any results.

grep "Failed to authenticate user" /var/log/system.log
grep "authentication error for" /var/log/system.log
I found out the keyword to look for is AuthenticationAllowed. 

Here is an example of a bad login:

2017-03-27 14:58:52.616248-0500  localhost com.apple.AccountPolicyHelper[226]: (78.701.2) AuthenticationAllowed completed: record "testuser", result: Success (0).
2017-03-27 14:58:52.616578-0500  localhost opendirectoryd[78]: Verify password result: 5000
2017-03-27 14:58:52.616620-0500  localhost opendirectoryd[78]: ODRecordVerifyPassword failed with error 'Invalid credentials' (5000)


And this is a good login:

2017-03-27 15:02:33.444367-0500  localhost com.apple.AccountPolicyHelper[226]: (78.702.2) AuthenticationAllowed completed: record “otheruser", result: Success (0).
2017-03-27 15:02:33.444540-0500  localhost opendirectoryd[78]: ODRecordAuthenticationAllowed completed


You can find these by using the log show —style syslog -last 5m command. This will show the last 5 minutes of messages.