I'm trying to run some commands when I start and stop using the (built in) webcam on my 2015 iMac running Catalina.

It sounds like historically lsof | grep "AppleCamera" would once tell me if the webcam is being used. However I'm not getting that to work on Catalina, is there an alternative process name or other method I can use to tell if the webcam is active?

  • You'd have to do this through AVFoundation because this handles all your audio/video both internal and external (USB). How exactly, I don't know yet...but this is the direction to go in.
    – Allan
    Jul 27 '20 at 23:05

I would recommend OverSight because it's free and written by a very talented Apple technology focused security researcher. His other tools are also extremely good.


  • Objective-See: a real arsenal of defense weapons. Many level of quality above what you usually see on the market of cyber-security. Patrick Wardle is a model in the field of cyber-defense.
    – dan
    Jul 28 '20 at 6:47

I haven’t reverse engineered how this company does it, but I do use this tool to log access so I would tail the log files from MicroSnitch to meet your needs.


My understanding of watching how this works is they figure out how to tap each specific event on each specific model and each macOS release to do this and not that there’s some one line command to tell what’s happening.

I could be wrong, but I know this tool and Little Snitch and LaunchBar are so worth it I just pay them money for the bundle.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .