2

Sorry if this is a basic question:

Is it possible to find out when a Mac was simply “powered on” (like just pressing the power button) and brought up to the login screen that shows the User Accounts, but NOT logging into any accounts ? So basically just starting up and then shutting down again without actually going further. Or would that mean that it’s too early so no logs/records/timestamps are created yet at that point ?

(I found some discussion here about logs but it doesn’t talk about just powering on: https://unix.stackexchange.com/questions/14127/how-to-know-when-and-which-user-logged-into-the-system-under-mac-os-x-last-is-n)

Thanks !

Improve this question

2 Answers 2

Reset to default
1

You can view this information using the last command in Terminal.app.

The last command brings up the login history in LIFO order. Each entry contains the name of the user who logged in, the local time the login occurred, and the duration of the login session.

Shutdowns and restarts are logged as pseudo-users named 'shutdown' and 'reboot,' making it a simple matter to see who (if anyone) has logged in since the last startup, or if multiple shutdowns/restarts occurred without anyone logging in between them.

Improve this answer
8
  • EDIT: so i actually tested out what you said, but I don't think the "last" command logs just "powering on" and "powering off" without logging in. For example, I just turned on my computer, then shut it off, turned it on shut it off, and turned it on again, then shut if off (all without ever logging in) and it only showed entries if you logged in. Thanks for your help though
    – catmac
    Jul 22, 2015 at 19:30
  • Also, any idea if this information is stored in a physical log file somewhere ? I have the hard drive files but can't' boot it up so I don't have access to terminal Thanks!
    – catmac
    Jul 22, 2015 at 19:40
  • Most recent item first: 'last' gets its data from /var/run/utmpx, which isn't a traditional log file and isn't directly readable.
    – Doc G.
    Jul 22, 2015 at 22:09
  • I'm at a loss as to understanding the difference between your experience and mine. Over a five minute period, I ran a series of three shutdowns and cold restarts, along with two warm reboots. In each case I went no further than the login screen and did not log in, using either the Restart or the Shutdown button on the login screen to cycle the computer. When I finally logged in and ran the 'last' command, only that one final login appeared in the sequence, and all of the shutdowns and restarts were present and timestamped in unbroken order with no login entries among them.
    – Doc G.
    Jul 22, 2015 at 22:40
  • okay, interesting. could it be because I enabled file-valt ? If that's the case, sorry for the confusion and I'll mark it as answered. otherwise I'm not sure at all. Thanks for your help though.
    – catmac
    Jul 23, 2015 at 1:01
0

You can find that information in /var/log/system.log (or, in the rotated log files /var/log/system.log.#.gz )

You can search for BOOT_TIME or SHUTDOWN_TIME to find the information you're looking for.

Jul 22 08:45:54 localhost bootlog[0]: BOOT_TIME 1437522354 0
Jul 22 17:41:27 localhost shutdown[1345]: SHUTDOWN_TIME: 1437554487 121139

These commands might be useful to you

gunzip -c /var/log/system.log.?.gz | grep BOOT_TIME
gunzip -c /var/log/system.log.?.gz | grep SHUTDOWN_TIME
grep BOOT_TIME /var/log/system.log
grep SHUTDOWN_TIME /var/log/system.log

Note that access to /var/log/system.log* is restricted to the admin user group.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .