I want to see which applications accessed my keychain of my Mac. Do know which apps have access and how often they do. Does macOS keep a log of that somewhere ?
-
3If you don't find a good answer, consider locking the keychain and then see when you're asked to unlock it. ProTip: you don't need to have your keychain password be the same as your account password. ProTip: you can store more sensitive entries in other keychains so you're prompted/secured by another passphrase if you desire.– bmike ♦Sep 12, 2017 at 10:37
-
I tried your suggestion to lock the keychain. Good idea. There is indeed an option for it. It then shows a small lock at the screen top. Then I was asked several times to unlock by processes that sound legit, but still I cancelled all. Even then after a while the lock showed unlocked. Strange. This happened several times. So in the end I just left in unlocked.– GijsSep 14, 2017 at 8:15
Add a comment
|
1 Answer
Yes, on MacOS Sierra or newer you can monitor every access to the Keychain, using the Unified Logging system in two operation modes:
Realtime
Query the database log to get past access events
Use this command on a Terminal window for Realtime monitoring:
log stream --predicate 'subsystem == "com.apple.securityd" AND message CONTAINS[cd] "Keychain Access"' --info --debug --signpost --style compact
Here is the output of the above command, in realtime, while some keychain items were being accessed:
You can also query past events by specifying some date range, and changing stream to show. Like the example below:
log show --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00" --predicate 'subsystem == "com.apple.securityd" AND message CONTAINS[cd] "Keychain Access"' --info --debug --signpost --style compact
More detailed information can be obtained by modifying the command line and grouping other process interactions. See man log for more options, or just ask here :)
