# Need osquery table name which keeps track of successful and failed root user logging information

**URL:** <https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174>\
**Category:** Kibana\
**Tags:** osquery-manager\
**Created:** [June 14, 2022, 2:23pm UTC](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174 "2022-06-14T14:23:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![niveditakathal](https://avatars.discourse-cdn.com/v4/letter/n/e19b73/32.png) [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\
**Post date:** [June 14, 2022, 2:23pm UTC](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174/1 "2022-06-14T14:23:49Z")

</div>

Hi Experts,

Can someone please assist me with the osquery table name which keeps track of successful and failed root user logging information?

Note: I already checked users, logged\_in\_users, but no luck.

Thanks,  
Nivedita

---

<div class="post-metadata">

**Author:** ![Melissa\_Burpo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/melissa_burpo/32/144702_2.png) [@Melissa\_Burpo](https://discuss.elastic.co/u/Melissa_Burpo)\
**Post date:** [June 15, 2022, 6:41pm UTC](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174/2 "2022-06-15T18:41:52Z")

</div>

Hi @niveditakathal,

There’s a table that can help with that for MacOS - [account\_policy\_data](https://osquery.io/schema/5.3.0/#account_policy_data) - but I’m not sure about other operating systems. I found an example query for that table in a question posted to the open source osquery project on Github: [Question about failed logins from MacOS](https://github.com/osquery/osquery/issues/7167).

I suspect that folks from the osquery community might be able to give you a more definitive answer or some tips about how to get the info you need. You could try joining the osquery Slack or possibly open an issue with the osquery project on Github. You can find links for both on [https://osquery.io](https://osquery.io).

Hope that helps!  
Melissa

---

<div class="post-metadata">

**Author:** ![niveditakathal](https://avatars.discourse-cdn.com/v4/letter/n/e19b73/32.png) [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\
**Post date:** [June 21, 2022, 8:43am UTC](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174/3 "2022-06-21T08:43:08Z")

</div>

@Melissa_Burpo Thanks for the assistance .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 19, 2022, 8:43am UTC](https://discuss.elastic.co/t/need-osquery-table-name-which-keeps-track-of-successful-and-failed-root-user-logging-information/307174/4 "2022-07-19T08:43:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.