6

How can I log all login history until now? By "all" I mean all users: admin, guests, and every other user.

I am using MacOS HighSierra.

8

In Terminal, use the last command.

Also, read the manual page for last, in Terminal: man last

| improve this answer | |
4

Checked on Mac OS Mojave 10.14.5

sudo log show --style syslog  --last 30m | awk '/Enter/ && /unlockUIBecomesActive/ {print $1 " " $2}'
| improve this answer | |
  • This command only catches GUI logins. It is OK if the user does not have [does not use] SSH logins on MacOS. Else it must use last which catches both. – Prado Aug 29 '19 at 18:34
  • I like log answers, +1. Is there any way to replace awk with log's --predicate, something like --predicate 'eventMessage contains …'? – grg Aug 29 '19 at 18:37
  • 1
    The last command is the accepted answer and provides user names. In addition to the issues @Prado mentioned, this solution doesn't show the user name. I doubt the poster was looking for just a list of times when logins occurred with no reference to the username. – Brandon Rader Aug 29 '19 at 18:57
  • @grg since you like logs, check my other answer here about using it apple.stackexchange.com/a/367784/341083 . About this thread, last is a specific command from UNIX/BSD just for that purpose, we can trust its results, logger can be rewritten and it not reliable for such thing, unless previously configured for longer data storage. I prefer last also for this reason. – Prado Aug 29 '19 at 19:07
  • @Prado last doesn't catch logins which happens after screen saver – DarkSatyr Aug 30 '19 at 12:23
1

log show --style syslog --last 30m --predicate 'eventMessage CONTAINS "unlockUIBecomesActive"' --info

Can also use

log show --style syslog --start "YYYY-MM-DD hh:mm:ss" --end "YYYY-MM-DD hh:mm:ss" --predicate 'eventMessage CONTAINS "unlockUIBecomesActive"' --info

etc.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .