2

In Mac OSX 10.12.1, using Terminal

last

does not show logins before today? I did read the earlier article and tried

sudo last

which did not reveal anything earlier.

migrated from unix.stackexchange.com Dec 8 '16 at 23:10

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

  • From a former responder that deleted their comment, it would seem this is because of logs prior to today being .gz compressed. Really? Is there not a single online capability to see all the logins in an OS X instance's history? – Sergio Dec 8 '16 at 16:28
  • What are the results of- syslog -k Sender login ? – fd0 Dec 8 '16 at 16:29
  • I deleted an answer that was not correct. According to man wtmp on macOS 10.12.1, "These files no longer exist in 10.5 or later. /var/run/utmp, /var/log/wtmp, /var/log/lastlog". – Christopher Dec 8 '16 at 16:36
  • 1
    The result of the syslog confirms what Christopher is saying: NOTE: Most system logs have moved to a new logging system. See log(1) for more information. – Sergio Dec 8 '16 at 16:37
1

last works in Sierra like in all older OS X systems equipped with ASL.

Here is an example of a Sierra VM (first light: installed: Sep 20, 2016):

user  ttys001                       Fri Dec  9 02:31   still logged in
user  ttys000                       Fri Dec  9 02:30   still logged in
user  console                       Fri Dec  9 02:30   still logged in
...
reboot    ~                         Wed Sep 21 00:01 
user  console                       Tue Sep 20 22:18 - crash  (01:42)
reboot    ~                         Tue Sep 20 22:18 
user  ttys000                       Tue Sep 20 22:08 - crash  (00:09)
_mbsetupuser  console               Tue Sep 20 22:01 - crash  (00:17)
user  console                       Tue Sep 20 22:00 - crash  (00:17)
reboot    ~                         Tue Sep 20 21:59 

You can check any misbehavior of last/ASL with Terminal.app:

Open a new shell and enter sudo opensnoop -n last, then open a tab with T and enter last.

In the first tab you should get something like:

  UID    PID COMM          FD PATH                 
  501   7281 last           3 /dev/dtracehelper    
  501   7281 last           3 /var/log/asl         
  501   7281 last           4 /var/log/asl/2016.12.04.G80.asl 
  501   7281 last          -1 /var/log/asl/2016.12.04.U0.asl 
  501   7281 last           5 /var/log/asl/2016.12.04.U501.asl 
  501   7281 last           6 /var/log/asl/2016.12.05.G80.asl 
  501   7281 last          -1 /var/log/asl/2016.12.05.U0.asl 
  501   7281 last           7 /var/log/asl/2016.12.05.U501.asl 
  501   7281 last           8 /var/log/asl/2016.12.06.G80.asl 
  501   7281 last          -1 /var/log/asl/2016.12.06.U0.asl 
  501   7281 last           9 /var/log/asl/2016.12.06.U501.asl 
  501   7281 last          10 /var/log/asl/2016.12.08.G80.asl 
  501   7281 last          -1 /var/log/asl/2016.12.08.U0.asl 
  501   7281 last          11 /var/log/asl/2016.12.08.U501.asl 
  501   7281 last          12 /var/log/asl/2016.12.09.G80.asl 
  501   7281 last          -1 /var/log/asl/2016.12.09.U0.asl 
  501   7281 last          13 /var/log/asl/2016.12.09.U501.asl 
  501   7281 last          14 /var/log/asl/BB.2017.09.30.G80.asl 
  501   7281 last          15 /var/log/asl/BB.2017.10.30.G80.asl 
  501   7281 last          16 /var/log/asl/BB.2017.11.30.G80.asl 
  501   7281 last          17 /var/log/asl/BB.2017.12.31.G80.asl 
  501   7281 last          18 /var/log/asl/Logs    
  501   7281 last          18 /var/log/asl/StoreData 
  501   7281 last           3 /etc/localtime       
  501   7281 last           3 /usr/share/zoneinfo/UTC

which shows all files opened/read by last. Quit opensnoop by entering: ^C.

If you don't get a similar output check your ASL subsystem (e.g. asl.conf or the launch daemons com.apple.syslogd/com.apple.aslmanager)/the folder /var/log/asl and repair everything if necessary.

  • Results from opensnoop on 10.12.1: dtrace: system integrity protection is on, some features will not be available and 33 of these: dtrace: error on enabled probe ID 5 (ID 188: syscall::open:return): invalid user access in action #11 at DIF offset 24. 33 corresponds to the files shown in the answer. Why that message? Results from last: good logins since Sep, 2016. Why not since Sep 2015 when I first logged in (upgrades)? How do we find bad logins? – Christopher Dec 9 '16 at 13:46
  • @Christopher I disabled SIP to get the opensnoop result. In my physical Mavericks install I get only the logins etc of the last ~one year (Dec 02, 2015-Dec 09, 2016) though I never reinstalled/deleted anything since Jan '14. You should convert your comment questions in one or several real ASE question here... ;-) – klanomath Dec 9 '16 at 13:56
  • Regarding _mbsetupuser see this question. – orome Mar 30 '17 at 12:11

You must log in to answer this question.