I'm trying to figure out how late I've been working for the last few months.

Normally my old line manager would not have given me time in lieu. However she was fired last week and I now stand a chance of getting some time back from the company.

The best measurement of when I stop work is when I last close my macbook each day. Could I find this out from the sys logs?

  • Instead of just closing the Macbook and putting it to sleep, shut it down. There are log entries for system shutdown and startup. – IconDaemon May 20 '19 at 10:20
  • 2
    I believe that Ward here wants to know a passed action, and not a way to do it in the future... – Edd Growl May 20 '19 at 11:21
  • Shutdowns register a distinct message in system.log: May 17 15:28:17 [redacted] com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): System shutdown initiated by: shutdown.7478<-sessionlogoutd.7336<-launchd.1. I can find no such distinct message for sleep. – IconDaemon May 20 '19 at 11:30
  • How about looking for the last save event - surely that's about the last thing you might do or close to? – Solar Mike May 20 '19 at 11:46
  • MacOS logs a prodigious amount of data. The good news is that you'll likely be able to find the log entries you need. The bad news is they may not be easy to find. I don't use the logs frequently, but as I understand it, the console app (in Launchpad, Other) is a tool that may prove useful. And as usual, the Internet has some tutorials: 1, 2. Another take here – Seamus May 20 '19 at 13:32

The last message before I opened my MacBook this morning was

5/19/19 22:43:36.000 kernel[0]: AirPort_Brcm43xx::powerChange: System Sleep 

I'm not sure I closed it at that time exactly last night but it was close.

I've just run an experiment now and it took about 15 seconds from my last activity before I close the lid until that message appears.

  • 1
    Just an FYI... If one's Wi-Fi is turned off, that message will not be in the logs. – user3439894 May 20 '19 at 13:35

So the closest answer I could get was this console command:

log show -v | grep "Entering Sleep state due to 'Clamshell Sleep'"

It's not perfect as it only goes back 6 weeks or so, and it shows more sleep messages than I need. But from the results set, its easy to pick out the last 'System Sleep' of the day.


After a quick bit of research, this may be worth a try. Open a terminal window to get the bash prompt, then:

$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --last 24h

I've included the --last 24h option so that you won't be inundated with data. Use this first to confirm that this will give you the data you need. If you may want to experiment with different predicate options, etc you can read all about it at man log.

I don't know how far back the system logs go on your system, so this will avoid a huge dump to your terminal. But of course if you don't mind a huge dump to your terminal, simply remove that option from the command line. Based on a previous answer here at "AskDifferent" the period of time that your logs will cover is apparently a function of some settings in the /etc/asl.conf file. That answer has a method to check & adjust those settings. However, in looking at my own asl.conf file, it differs some from the settings in the referenced answer (e.g. there is no ttl limit in my asl.conf). And so, you may not know how far back you can go until you actually try. If the entire period of interest isn't in the logs, I don't have any ideas, except to increase the log limits in asl.conf to avoid that issue in the future, or perhaps set up log rotation.

A couple of other points:

  1. If you don't use sudo, you may get the following odd error message:

log: Could not open local log store: The log archive format is corrupt and cannot be read

That message is likely false and misleading; use sudo, and it should disappear (unless your logs truly are corrupted!).

  1. If you want to save the log output to a file, that's easy enough:
$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --last 24h >> ~/MyClamshellClosures.txt 
  1. And finally, if you want to see log entries for a range of dates, e.g. YTD:
$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --start "2019-01-01" --end "2019-05-19" >> ~/MyClamshellClosures.txt 


If you don't wish to use the command line, the Console app in Launchpad, Other may also be used. I prefer the command line, but there are some decent and current tutorials that may help:

  1. Fm 'techbland.com', May 15, 2019

  2. Fm 'howtogeek.com', Mar 19, 2019

  • 1
    The OP stated "I'm trying to figure out how late I've been working for the last few months.", and the sudo log show --predicate 'eventMessage contains "Clamshell change detected"' command (without the --last 24h option) only went back two weeks. So while helpful for the last two weeks, it doesn't appear to be helpful beyond that range. Also, searching in Console for "Clamshell change detected" only yielded that sudo executed that command, so it looks like the log command from Terminal will need to be used. – user3439894 May 20 '19 at 15:42
  • 1
    BTW Adding the e.g. the --last 30d option to the log command, in an attempt to get more than two weeks, yielded the same results as without it. So it appears anything beyond two weeks will not be able to be validated in this manner and isn't sufficient to cover the time range mentioned in the OP. – user3439894 May 20 '19 at 15:42
  • @user3439894: Have you found something in the documentation stating that all logs are purged after 30 days? Could that be peculiar to your machine? – Seamus May 20 '19 at 16:45
  • 1
    My system has been running with the default installed settings for any logging for the last year since I clean build macOS High Sierra on it. I have never run any app or issued any command that cleans up any logs. I open and close the Clamshell every day and for me it only shows the last two weeks. – user3439894 May 20 '19 at 16:55
  • 1
    I am fully aware of the contents of the link you provided in your last comment, but modifying the /etc/asl.conf as shown in the link of your comment is for the /var/log/system.log file and the "Clamshell change detected" message is not stored in the /var/log/system.log file on my system. So I'm not sure what relevance that part of your answer has in this scenario? – user3439894 May 20 '19 at 17:45

IF you have the Command Line Tools installed, the BSD command last will give you the date and time for shutdown and reboot. Use it as last -n where n is the number of lines to display . Also the man page is useful.

  • 1
    How do shutdown and restart times relate to system sleeps triggered by closing the laptop lid? – nohillside May 20 '19 at 13:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .