Dropbox, PushBullet, Thunderbird and a dozen other apps create notifications. Is it possible to log these in a Unix-like way?

I dislike the tiny messages popping up for a few seconds and then disappearing without a trace.

Basically, I want to be able to grep a file which contains a line for each notification.

  • This answer and this one indicate there is a notification center SQLite database. It's not simple plain text though. – Arthur Sep 30 '15 at 12:00

As was linked by Arthur Hammer, https://apple.stackexchange.com/a/142811/37689 states that notifications are stored in an SQLite database. The following python script should get you started:

#!/usr/bin/env python
import os
import re
import sqlite3

# Location of notification centers database under Yosemite
tmp = os.environ['TMPDIR']
conn = sqlite3.connect(tmp + '/../0/com.apple.notificationcenter/db/db')

for notification in conn.execute('SELECT * from notifications'):
    encoded_data = str(notification[-1]) # last item
    clean = re.sub('[^\w\s-]', '', encoded_data) # remove some funny stuff (fixme: removes too much?)
    sp = clean.split('\t')
    # Find NSActualdeliverydate, message content seems to always come after this
    for ix in range(len(sp)):
        if 'NSActualdeliverydate' in sp[ix]:
    # Skip blanks
    for ix in range(ix+1, len(sp)):
        if sp[ix] != '': break

    print 'notification', sp[ix].replace('_', '\n').strip()


You can then either pipe this to a file and then grep the file, or just grep the output of the script directly.

  • Thank you. PushBullet, Dropbox and the other apps I was investigating do not appear to log the relevant data though, sadly. I dumped the sqlite databases and grepped for tokens/strings that I want info on (like the notification titles, files, sourcee, etc - and nothing came up. – sente Dec 31 '15 at 22:08

First locate the sqlite files db and db-wal where notification reside. As in mojave, could be found using this command:

lsof -p $(ps aux | grep -m1 usernoted | awk '{ print $2 }')| awk '{ print $9 }' | grep 'db2/db$' | xargs dirname

Then as @greenhouse mentioned, MacFronsics script is good choice to parse db file. As far as I test the script supports mojave as well.

In case someone fail to get latest notification, the most recent notifications are not likely in main db. Directly parsing db file would end up with old notifications. If you want latest notifications, remember migrate the record in db-wal(Write AHead Log) file to db first.


@oystein's answer is great, but i guess it only works for yosemite because the sqlite db for high sierra is a different db model...

so i found this easy tool... (which works for high seirra perfectly) https://github.com/ydkhatri/MacForensics/blob/master/macNotifications.py

just run with your db path input and output path .csv that you would like to create

note: to find your notification center db path, view this... https://stackoverflow.com/a/26777027


Not the answer you're looking for? Browse other questions tagged .