13

Does Mac OS record user logins/logouts?

I'm in a situation where I need to show that a certain user was logged in at a certain time (long story) less than four weeks ago.

Is this recorded at the Mac OS level or Darwin level anywhere?

EDIT: The machine is running Mac OS Leopard (non-server edition).

15

You can try the command last which unless the log has been cleared should have a log right back until the OS was installed. Specifically look for any console entries.

  • 1
    Sweet! I was right, to. Even sweeter. – Justicle Nov 4 '09 at 4:32
  • 3
    This is for shutdown, reboots. How about "lock screens" logins, there is something similar? – Paulo Oliveira May 25 '16 at 11:21
  • How to check for lock screen logins? – theonlygusti Aug 21 '17 at 15:09
10

If you want to look back further than the few weeks that last will show these entries are stored for much longer in the ASL database. To view logins use this command, substituting the name you are searching for, or leave off the | grep insert_username_here to see everyone.

syslog -F raw -k Facility com.apple.system.lastlog | grep insert_username_here

To see logouts use:

syslog -F raw -k Facility com.apple.system.utmpx | grep insert_username_here

To view this more cleanly you could use this, which does not show logins via terminal and will show just the epoch times. You must grep for a username or else the data is meaningless:

syslog -F raw -k Facility com.apple.system.lastlog | grep insert_username_here | grep -v tty | awk '{ print $2 }' | sed -e 's/]//g'

The date is displayed as the epoch time. You can convert that to normal time with http://www.epochconverter.com/

  • 1
    Thanks for the tip. FYI I was after "GUI" logins, so this should do the trick as well. – Justicle Nov 5 '09 at 1:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.