It appears different versions of macOS use different logs to repersent this. None of which, I have found, show a different log for a "login" or an "unlock". I have answered the next best thing: How to find all logins/unlocks. The following terminal commands will show you the date in time in which a login or unlock occurred.
With the help of this answer, and spending an hour looking through logs I figured this out:
P.S. You can additionally use the helpful --last
tag to limit to a specific time relative to now. For example --last 5m
would only be the last 5 minutes, --last 5h
would be the last 5 hours, and --last 5d
would be last 5 days.
macOS Mojave
Check for blocked unlock attempts (Invalid password or Touch ID):
log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider activate]_block_invoke"
Explanation: The command will look through the logs and find ones that are from the process "loginwindow"
and contain LUIAuthenticationServiceProvider activate]_block_invoke
.
Check for valid unlock attempts (Valid password or Touch ID):
log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke"
Explanation: The command will look through the logs and find ones that are from the process "loginwindow"
and contain LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke
.
macOS High Sierra
WIP
Check for blocked unlock attempts (Invalid password or Touch ID):
...
Check for valid unlock attempts (Valid password or Touch ID):
log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LAClient evaluatePolicy:options:uiDelegate:reply:]_block_invoke"
macOS Sierra
Check for blocked unlock attempts (Invalid password or Touch ID):
log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "Verify password called with PAM auth set to YES, but pam handle == nil"
Check for valid unlock attempts (Valid password or Touch ID):
log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "SecKeychainLogin result: 0, password was supplied"