Note that this does not work on 10.5. As of Leopard, the system no longer writes security messages to /var/log/asl.log but instead requires the use of syslog to retrieve messages from /var/log/asl.db . It may be possible to change the authsight script to use this instead but it's not as easy as using tail -f.