1

My computer was up to some strange things. I used the "last" command to check login activity and this is the result. Not only have I never seen it before this, all of my previous logins were missing, as you can see.


Last login: Wed Aug  3 03:35:37 on ttys001
/Library/Application\ Support/Apple/Remote\ Desktop/Notify
 ; exit; 
Jason@workstation ~ % /Library/Application\ Support/Apple/Remote\ Desktop/Notify
 ; exit;

[Process completed]

Is this something I should be concerned about or a sign my machine was compromised or remotely accessed?

1
  • 3
    This doesn't show the output of last, it rather looks as if the startup files of your shell have an error and immediately terminate the shell again. In this state, you can't even run last. So, before any further analysis, you should fix the startup file of your shell (probably ~/.zshrc).
    – nohillside
    Commented Feb 24 at 8:36

2 Answers 2

1

I'm assuming you are logged in to the shell. I'm also assuming your prompt looks as it should. I'm also assuming that other commands don't give a similar result.

That almost certainly isn't the output of last. You may have a script in your path or an alias in your .zshrc file. It could even be something in your prompt.

Try which last which should tell you if either of first two are true. The correct output from it should be /usr/bin/last.

You could even try the complete path yourself :- /usr/bin/last Now what do you get?

I would also not try and be smart with command line options, I would run the command with none.

1

Something is executing the Apple-created shell script /Library/Application\ Support/Apple/Remote\ Desktop/Notify. That script then runs, does what it was told to do, and then exits your shell once it's finished. If this happens each time you manually open up a new terminal window then I must guess that executing this script has been placed in your shell initialization files (.profile, .bash_profile, .zshrc, etc.)

Or perhaps the Notify script has inadvertently been added to your normal Login Items within the System Settings -> General.

This 'last login' output is coming from the login DB (perhaps /var/log/utx.log depending on your OS version). It's telling you that that last login was a local connection from your terminal app connecting to the special character device named ttys001.

If it was a remote incoming connection via SSH or such then the output would instead reference the source IP address. It would appear more like:

Last login: Mon Jan 01 02:34:56 2024 from 257.258.259.260

You can use the /usr/bin/last to list all of the opened and recorded shell sessions. last -w is my typical execution but there are many different options and arguments available.

It's not unusual that the content of the last login DB is rotated on a monthly basis. If you're an infrequent shell user that might explain why you don't see prior shell sessions when running last.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .