14

I'd be immensely grateful if someone helped me get the last screen unlocks (such as by going to the Apple menu > lock screen). With unlock I mean when you lock the screen then you have to unlock it by entering the password. I guess this is registered in some log file or there's some Terminal command to get this.

I guess this must be possible because, when you use parental controls and you set up a time limit for a user, if the user locks the screen, the time on lock screen doesn't seem to count against the allowed time, which seems to imply that lock screens are registered in some log file??

The following is in a screenshot of an excerpt from the terminal output after running the High Sierra code listed in @JBis's answer: enter image description here

|improve this question
9
+50

If you go to the Console app on your Mac (it is located in Applications/ Utilities folder) and click on "Macs Analytics Data" which appears on the left side of the window. This report has a message "loginwindow" and is stamped with a time and has the word "screenlock" on the same line. I just locked and screen and then unlocked it and I got that message. You could grep out all the "loginwindow" terms and the "screenlock" terms. This should give you a list of times these events happened.

This log can be located with Finder by right-clicking it > reveal in finder (at least in macOS High Sierra)

|improve this answer
  • 1
    Wow! that seems to be the one, but it seems to show only the last 3 days, is there a way to see more time back? – Antonio23249 Jul 28 '18 at 22:28
  • That I don't know. Sorry. – jmh Jul 28 '18 at 22:39
  • Best I can tell my messages go back 5 days. It looks like a search on "Lockscreen" is best. – jmh Jul 28 '18 at 22:42
  • Thanks a lot, what should I do so you receive this bounty stuff? ..never done it before. – Antonio23249 Jul 28 '18 at 22:42
  • At work we need to get the last usage for any of the macs we receive for repair, this may help a lot. Being able to unlock the mac is a good piece of data that the user was actually using the machine. – Antonio23249 Jul 28 '18 at 22:44
14

It appears different versions of macOS use different logs to repersent this. None of which, I have found, show a different log for a "login" or an "unlock". I have answered the next best thing: How to find all logins/unlocks. The following terminal commands will show you the date in time in which a login or unlock occurred.

With the help of this answer, and spending an hour looking through logs I figured this out:

P.S. You can additionally use the helpful --last tag to limit to a specific time relative to now. For example --last 5m would only be the last 5 minutes, --last 5h would be the last 5 hours, and --last 5d would be last 5 days.

macOS Mojave

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider activate]_block_invoke"

Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider activate]_block_invoke.

Check for valid unlock attempts (Valid password or Touch ID):

 log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke"

Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke.

macOS High Sierra

WIP

Check for blocked unlock attempts (Invalid password or Touch ID):

...

Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LAClient evaluatePolicy:options:uiDelegate:reply:]_block_invoke"

macOS Sierra

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "Verify password called with PAM auth set to YES, but pam handle == nil"

Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "SecKeychainLogin result: 0, password was supplied"
|improve this answer
  • I tried both and they don't return anything. You seem to be aimed in the right direction. I'm not very literate with Terminal, what do those search, the system.log?, I couldn't find any "UIAuthenticationServiceProvider deactivateWithContext:]_block_invoke" in the system.log. Thanks a lot for your effort, I really need this. – Antonio23249 Jul 28 '18 at 8:32
  • @Antonio23249 See update. – JBis Jul 28 '18 at 12:21
  • Hi there, Thanks again…well, this doesn’t seem to be working, I locked then unlocked the screen at 16:42:50 then restarted the machine and 16:06:10, I waited for a couple of minutes to give the logs time to catch up. According to this the last unlock was on 2018-07-28 17:13:28.241846+0100 right? This is a Mac Mini 2014 on macOS High Sierra 10.13.6 – Antonio23249 Jul 28 '18 at 16:20
  • Well a login maybe also trigger this log because a login is well unlocking it. Did the 16:42:50 event even show? Theoretically it should be the second one. – JBis Jul 28 '18 at 16:22
  • I've added a screenshot of the result to my original post above (I couldn't add it anywhere else). I've added it again, first screenshot I added wasn't right – Antonio23249 Jul 28 '18 at 16:25
-1

Open terminal and type 

last

this should provide log info

here's the manual page of this command :

last manual

|improve this answer
  • Thanks for your answer, are you sure that one shows screen unlocks? it seems to show only actual log-ins – Antonio23249 Jul 20 '18 at 11:25
  • You are correct, @Antonio23249. A screen unlock is not a new login. last only shows last logins. From man last: Last will list the sessions of specified users, ttys, and hosts, in reverse time order. Each line of output contains the user name, the tty from which the session was conducted, any hostname, the start and stop times for the session, and the duration of the session. If the session is still continuing or was cut short by a crash or shutdown, last will so indicate. – IconDaemon Jul 20 '18 at 13:00
  • Thanks for your answer anyway, I've started a bounty on it. I guess this must be possible because, when you use parental controls and you set up a time limit for a user, if the user locks the screen, the time on lock screen doesn't seem to count against the allowed time, which seems to imply that lock screens are registered in some log file?? – Antonio23249 Jul 28 '18 at 1:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .