9

How can I log all login history until now? By "all" I mean all users: admin, guests, and every other user.

I am using MacOS HighSierra.

Improve this question

3 Answers 3

Reset to default
10

In Terminal, use the last command.

Also, read the manual page for last, in Terminal: man last

Improve this answer
4
  • Is there something that has changed from 10.11 (El Capitan) to 10.13 (High Sierra)? I'm asking because if I type last in the terminal on El Capitan, the only output I get is wtmp begins Mon Oct 25 16:40, or 5 mins later wtmp begins Mon Oct 25 16:45. The man page says: "If no users, hostnames or terminals are specified, last prints a record of all logins and logouts."
    – Alex Ixeras
    Oct 25, 2021 at 5:49
  • @Alex Ixeras, I just booted an OS X 10.11.6 system and the last command is working as stated in its manual page and shows my current login and other previous ones along with reboot and shutdown times.
    – user3439894
    Oct 25, 2021 at 12:28
  • Thanks. Would you know why my output is so different? Is there any setting I’m missing?
    – Alex Ixeras
    Oct 25, 2021 at 22:15
  • @Alex Ixeras, If you are having an issue, then I'd suggest you post a question.
    – user3439894
    Oct 25, 2021 at 22:19
4

Checked on Mac OS Mojave 10.14.5

sudo log show --style syslog  --last 30m | awk '/Enter/ && /unlockUIBecomesActive/ {print $1 " " $2}'

The above no longer works in macOS Sonoma, but this seems to:

sudo log show --style syslog  --last 1d | awk '/CA sending unlock success to dispatch/ {print $1 " " $2}'
Improve this answer
8
  • This command only catches GUI logins. It is OK if the user does not have [does not use] SSH logins on MacOS. Else it must use last which catches both.
    – Prado
    Aug 29, 2019 at 18:34
  • I like log answers, +1. Is there any way to replace awk with log's --predicate, something like --predicate 'eventMessage contains …'?
    – grg ♦
    Aug 29, 2019 at 18:37
  • 1
    The last command is the accepted answer and provides user names. In addition to the issues @Prado mentioned, this solution doesn't show the user name. I doubt the poster was looking for just a list of times when logins occurred with no reference to the username.
    – Brandon Rader
    Aug 29, 2019 at 18:57
  • @grg since you like logs, check my other answer here about using it apple.stackexchange.com/a/367784/341083 . About this thread, last is a specific command from UNIX/BSD just for that purpose, we can trust its results, logger can be rewritten and it not reliable for such thing, unless previously configured for longer data storage. I prefer last also for this reason.
    – Prado
    Aug 29, 2019 at 19:07
  • 1
    @Prado last doesn't catch logins which happens after screen saver
    – DarkSatyr
    Aug 30, 2019 at 12:23
0

log show --style syslog --last 30m --predicate 'eventMessage CONTAINS "unlockUIBecomesActive"' --info

Can also use

log show --style syslog --start "YYYY-MM-DD hh:mm:ss" --end "YYYY-MM-DD hh:mm:ss" --predicate 'eventMessage CONTAINS "unlockUIBecomesActive"' --info

etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .