title: Mac OS Sierra log show missing SSH source IP
body: <p>Before, we can track all the SSH logins either success/failure in OS X El Capitan.   When moved to OS Sierra, It seems that all the logs were moved which can be viewed by log show, log stream, and syslog.
  We can't track the source IP of an SSH process by looking those logs. e.g. :</p>
  
  <pre><code>Jun 27 15:38:47 MAC sshd: administrator [priv][240] &lt;Notice&gt;: USER_PROCESS: 243 ttys000
  Jun 27 15:39:34 MAC sshd: administrator [priv][249] &lt;Notice&gt;: USER_PROCESS: 257 ttys001
  Jun 27 15:42:50 MAC sshd: administrator [priv][249] &lt;Notice&gt;: DEAD_PROCESS: 257 ttys001
  </code></pre>
  
  <p>Screen sharing logs works perfectly just like before:</p>
  
  <pre><code>screensharingd: Authentication: SUCCEEDED :: User Name: administrator :: Viewer Address: 10.X.X.X :: Type: DH
  </code></pre>
  
  <p>Though we can see the logs of sshd if the attempt failed:</p>
  
  <pre><code> sshd: error: PAM: authentication error for administrator from 10.10.5.73
  </code></pre>
  
  <p>Any help will be greatly appreciated.<br>
  Thank you very much.</p>