Any way to get the last times the screen was unlocked in macOS?

Question

I'd be immensely grateful if someone helped me get the last screen unlocks (such as by going to the Apple menu > lock screen). With unlock I mean when you lock the screen then you have to unlock it by entering the password. I guess this is registered in some log file or there's some Terminal command to get this.

I guess this must be possible because, when you use parental controls and you set up a time limit for a user, if the user locks the screen, the time on lock screen doesn't seem to count against the allowed time, which seems to imply that lock screens are registered in some log file??

The following is in a screenshot of an excerpt from the terminal output after running the High Sierra code listed in @JBis's answer:

Answer 1

If you go to the Console app on your Mac (it is located in Applications/ Utilities folder) and click on "Macs Analytics Data" which appears on the left side of the window. This report has a message "loginwindow" and is stamped with a time and has the word "screenlock" on the same line. I just locked and screen and then unlocked it and I got that message. You could grep out all the "loginwindow" terms and the "screenlock" terms. This should give you a list of times these events happened.

This log can be located with Finder by right-clicking it > reveal in finder (at least in macOS High Sierra)

Answer 2

It appears different versions of macOS use different logs to repersent this. None of which, I have found, show a different log for a "login" or an "unlock". I have answered the next best thing: How to find all logins/unlocks. The following terminal commands will show you the date in time in which a login or unlock occurred.

---

With the help of this answer, and spending an hour looking through logs I figured this out:

P.S. You can additionally use the helpful --last tag to limit to a specific time relative to now. For example --last 5m would only be the last 5 minutes, --last 5h would be the last 5 hours, and --last 5d would be last 5 days.

---

macOS Mojave

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider activate]_block_invoke"

Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider activate]_block_invoke.

---

Check for valid unlock attempts (Valid password or Touch ID):

 log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke"

Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke.

---

macOS High Sierra

WIP

Check for blocked unlock attempts (Invalid password or Touch ID):

...

---

Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LAClient evaluatePolicy:options:uiDelegate:reply:]_block_invoke"

---

macOS Sierra

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "Verify password called with PAM auth set to YES, but pam handle == nil"

---

Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "SecKeychainLogin result: 0, password was supplied"

Answer 3

MacOS Catalina has a log format different from Mojave. Based on the answer from JBis, I wrote a script for Catalina called lockunlock.sh

#!/bin/sh
PERIOD=1d
if [[ $# -ge 1 ]]; then
    PERIOD=$1
fi
echo "Times of Mac screen lock and unlock events in the past ${PERIOD}:"
SEARCH_FOR="going inactive, create activity semaphore|releasing the activity semaphore"
log show --style syslog --predicate 'process == "loginwindow"' --debug --info --last ${PERIOD} | grep -E "${SEARCH_FOR}" | cut -c '1-32 141-155'

To arrive at the desired search term, I locked and unlocked my computer to make sure there were events, then viewed the last minute of log with

log show --style syslog --predicate 'process == "loginwindow"' --debug --info --last 1m | less

Answer 4

In Catalina the solution I finally arrived at is:

1. Open Terminal
   • If you are not logged in as an admin, then use su username to first authenticate as admin "username". I use this because I'm checking my kid's login history on his Mac without having to log him out and disrupt his stuff.
2. log show --last 1d | grep "UserActivity Assertion"
   • If you want to see more or less history back in time, change the "1d" to "2h" or "10m" (see documentation by running man log).
   • If you omit the --last modifier, it will take a really long time to run, maybe more than 10 minutes.

This seems to reliably show each time the machine was woken from sleep by the user unlocking the lock screen with their password.

Answer 5

This gives you the seconds since the last unlock/lock:

function  getlastunlock-darwin() {
    date="$(log show --style syslog --predicate 'process == "loginwindow"' --debug --info --last 1d | command rg "going inactive, create activity semaphore|releasing the activity semaphore" | tail -n1 |cut -c 1-31)" fromnow
}
function fromnow() {
    python3 -c 'import datetime ; from dateutil.parser import parse ; import os
date = parse(os.environ["date"])
print((datetime.datetime.now(date.tzinfo) - date).total_seconds())'
}

Answer 6

Open terminal and type

last

this should provide log info

here's the manual page of this command :

last manual