3

I need a list of the periods of times I used my MacBook throughout the last 30 days.

It would be sufficient to have a list of all lid-open and lid-close datetimes (because I close the lid whenever I don't use the MacBook). A chronological list of all sleep / wakeup / poweroff / poweron (and maybe login) datetimes would help as well.

What didn't help:

  • Googling
  • The last command
  • Filtering /var/log/system.log (which btw only contains one day)
  • Filtering the console app (but maybe there's a way...)
  • system.log gets rotated every so often and you can see the previous logs if you look in console for system.log.0.gz, system.log.1.gz etc. I don't know if even these will go back 30 days however. – Fyrefly Oct 29 '14 at 21:09
6

If it is sufficient to have a list of all sleep/wake cycles (lid-open, lid-close), you can run:

pmset -g log | grep ' Wake '

or

pmset -g log | grep ' sleep '

Play around with the string passed to grep to get the information that you need.

  • Wow, thanks for this fast answer. This looks promising! Any chance to output more than 14 days using pmset? (I need at least 30 days) – Joshua Sep 30 '14 at 19:39
  • 2
    This didn't work for me on OSX. It gave me incorrect date times. But this worked like a charm: pmset -g log | grep 'Display is turned on'. – Iulian Onofrei May 6 '15 at 7:20
1

I looked at this a bit and it seems doable, but you'll need to look at your behaviour with the system over time to determine exactly what messages in the logs to grep. I did the following set of steps to analyze the full history of sleep/wake cycles for this MacBook and it goes back all the way to Aug 12.

Preconditions: Writing to non-root user into ~/Downloads. Change paths and output filenames as desired.


#!/bin/bash
#
# Read system wake/sleep cycles from kernel logs from oldest to newest.
#
# First, read the archived kernel logs for wakes.
for file in $(ls -r /var/log/kernel.log.*) ; do   bunzip2 -c $file | grep 'Wake reason:' >> ~/Downloads/wakeup.txt; done
#
# Read current kernel.log for wakes.
grep 'Wake reason:' /var/log/kernel.log >> ~/Downloads/wakeup.txt
#
# Read archived kernel logs for sleeps.
for file in $(ls -r /var/log/kernel.log.*) ; do   bunzip2 -c $file | grep ': sleep' >> ~/Downloads/wakeup.txt; done
#
# Read current kernel.log for sleeps.
grep ': sleep' /var/log/kernel.log >> ~/Downloads/wakeup.txt
#
# Sort raw output from greps for chronological picture.
sort -o ~/Downloads/sortedwake.txt ~/Downloads/wakeup.txt

That should give you a decent jump on arriving at a more complete picture. You can examine the kernel logs to let you know when the system was rebooted, etc. Once you know what to filter on, you'll be able to expand on this quite a bit. Have fun with it.

Oh, one final note: If you're examining a system that visits many networks, you'll see your system name changing in the logs according to what the DNS server associates with your IP address. It looks a little odd, but it's quite normal behaviour.

  • Thanks for your detailed answer! I played a little bit with your script and had to modify the following things - files are named system.log instead of kernel.log on my MacBook - instead of bunzip2 I need to use gunzip - remove old files at the beginning rm ~/Downloads/wakeup.txt rm ~/Downloads/sortedwake.txt Then your script works well BUT it unfortunately contains only 9 days of history (the oldest log file is system.log.9.gz). Are there any older hidden backups anywhere? – Joshua Oct 28 '14 at 17:16
  • All right, from reading apple.stackexchange.com/questions/77373/… I found out that the system.log files will be rotated automatically and pruned after some days. I will try to change /etc/newsyslog.conf as follows: /var/log/system.log 640 40 * @T00 J This will in future hopefully preserve my system.log files for 40 days. (Sorry for the ugly formatting, mini-Markdown is broken at the moment) – Joshua Oct 28 '14 at 17:41
  • @Joshua, good luck with it. – Trane Francks Oct 29 '14 at 6:40
1

I finally wrapped it up in a oneliner which extracts system sleep and wake events from several log files:

(pmset -g log|grep -e " Sleep " -e " Wake "; syslog | grep -e "System Sleep" -e " Wake reason:") | more

If your system already uses log instead of syslog use the following command instead:

(pmset -g log|grep -e " Sleep " -e " Wake "; log show | grep -e "System Sleep" -e " Wake reason:") | more

  • Hint 1: pmset is limited to 14 days
  • Hint 2: The syslog command automatically searches archived system.log entries as well. By default there are 10 daily system.log backups. To save 30 days of system.log backups for future reference add the following line to /var/log/newsystemlog.conf: (still evaluating how well this works)


    /var/log/system.log                     640  30     *    @T00  J
    

@trane-francks @aglasser Thanks for your contributions! They helped to track the problem down.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .