0

I use Big Sur. I'm looking for any USB/external hard drive mounts in my computer from the last 30 days. I tried searching for " USBMSC" in my console log files for the day, when I knew there was at least one mount that day, but nothing came up, so it's inaccurate. Where/how can I accurately find USB/external hard drive mounts in Terminal?

1 Answer 1

0

Here's one way:

log show --debug --last 30d --predicate "sender == 'Sandbox' AND eventMessage matches 'identified disk[0-9]+ as removable'"

Note that this can take an extremely long time to run (several minutes per day of logging, i.e., one hour or more in your case!) due to the highly inefficient search algorithm used by the log command so if you don't need 30 days of history, you can reduce the number specified in the --last XXXd argument or use the --start and/or --end arguments to specify start and end timestamp ranges, respectively. See man log and log help show for more details.

3
  • Thank you so much! How do I find the system log files from the last 60 days?
    – mouse1985
    Commented Dec 23, 2021 at 14:24
  • @mouse1985 I mean, just change the 30 to a 60 :) Or are you asking a more general question about any logs? If so, then I believe you've already asked that question separately: apple.stackexchange.com/questions/433971/… and the answer by @nohillside is basically correct: The system purges old logs and it's unlikely to have kept two months' worth. But you can use the --start and --end arguments and just remove --predicate to choose any date range to view. Again, see man log and log help show.
    – pion
    Commented Dec 23, 2021 at 15:37
  • @mouse1985 If I have answered your original question to your satisfaction, would you kindly mark my answer as accepted? (Click the checkmark to the top-left of my answer.) Thank you!
    – pion
    Commented Dec 23, 2021 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .