If you didn't install system accounting on this Mac, there isn't any way
for you to get the processes back at the time of this bad event.
You can find when this mouse was connected for the last time by searching in the
/var/log/kernel.log. Within a
xterm just type:
grep -i usb /var/log/kernel.log
If you need to search back further, just use the compressed and saved previous versions with:
bzgrep -i usb /var/log/kernel.log..bz2
To check who was connected on your system, just use the
If you want to have a basic auditing function on your system, you may easily start by turning the system accounting on. Here is how to turn it on.
All these commande have to be typed with the
root account. (Be carefull any typed letter, even a space counts).
You can immediatly check that from now on and forever the kernel is registering any program launched:
As a simple example of use, the following command will show you which commands where used since the startup of the kernel accounting: