7

I want to see which applications accessed my keychain of my Mac. Do know which apps have access and how often they do. Does macOS keep a log of that somewhere ?

2
  • 3
    If you don't find a good answer, consider locking the keychain and then see when you're asked to unlock it. ProTip: you don't need to have your keychain password be the same as your account password. ProTip: you can store more sensitive entries in other keychains so you're prompted/secured by another passphrase if you desire.
    – bmike
    Sep 12, 2017 at 10:37
  • I tried your suggestion to lock the keychain. Good idea. There is indeed an option for it. It then shows a small lock at the screen top. Then I was asked several times to unlock by processes that sound legit, but still I cancelled all. Even then after a while the lock showed unlocked. Strange. This happened several times. So in the end I just left in unlocked.
    – Gijs
    Sep 14, 2017 at 8:15

1 Answer 1

5

Yes, on MacOS Sierra or newer you can monitor every access to the Keychain, using the Unified Logging system in two operation modes:

  1. Realtime

  2. Query the database log to get past access events


Use this command on a Terminal window for Realtime monitoring:

log stream --predicate 'subsystem == "com.apple.securityd" AND message CONTAINS[cd] "Keychain Access"' --info --debug --signpost --style compact

Here is the output of the above command, in realtime, while some keychain items were being accessed:

enter image description here

You can also query past events by specifying some date range, and changing stream to show. Like the example below:

log show --start "2019-08-11 14:21:45" --end "2019-08-11 14:22:00" --predicate 'subsystem == "com.apple.securityd" AND message CONTAINS[cd] "Keychain Access"' --info --debug --signpost --style compact

More detailed information can be obtained by modifying the command line and grouping other process interactions. See man log for more options, or just ask here :)

2
  • Note that this doesn't include applications accessing resources they stored in the keychain
    – Allison
    Oct 11, 2019 at 16:00
  • I changed "Keychain Access" to "Keychain" and got some additional useful messages.
    – JW.
    Mar 17, 2020 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .