See the exact date & time a user locks and unlocks his work station - running Fedora 18.


Is there any way to log an event of a user entering and exiting "lock-screen" on fedora 18 (or a general linux solution)?


  1. Tried looking at /var/log/boot - no help. And looking at /var/log/messages I found the message systemd-logind[xxx]: New session 140 of user YYY, but could not find the lock-screen (gnome?) event.
  2. Tried looking at /var/log/audit/audit.log which has a lot of PAM related messages about all sort of users and services, but I'm not really sure what to look for to find the lock-screen activity

Here is another solution using "dbus-monitor". A little bash script logging screen activity.

echo "$(date) Monitoring Terminated."
trap "exit_report; exit;" 0

lockmon() {
adddate() {
    while IFS= read -r line; do
      echo "$(date) $line" | grep "boolean" | sed 's/   boolean true/Screen Locked/' | sed 's/   boolean false/Screen Unlocked/'
echo "$(date) Monitoring Started."
dbus-monitor --session "type='signal',interface='org.gnome.ScreenSaver'" | adddate


lockmon >> lock_screen.log
| improve this answer | |
  • I put this in a .sh file and added it to Gnome's startup applications. Does what it says on the tin, thx – aross Dec 18 '17 at 14:34

Try to take a look at /var/log/auth.log. You should see some related messages from PAM and/or the screensaver application.

| improve this answer | |
  • I have no /var/log/auth.log, I do have /var/log/audit/audit.log which has a lot of PAM related messages about all sort of users and services, but I'm not really sure what to look for to find the lock-screen activity – tutuDajuju Oct 21 '13 at 8:24
  • I have /var/log/auth.log and there's no message from PAM nor the screensaver app relative to the lock up / lock out events. – ychaouche Dec 4 '19 at 12:14

Yes it doesn't seem to be logged anywhere for you. @tutuDajuju has a good solution so I thought I'd port it to bash (and remove the dependence on using gnome, this should work regardless of desktop environment) for those that are interested.
If you have this running in the background and pipe it to a log file you will have your log.


#prints out, among other things;
#      string "org.kde.screensaver"
#transform it to 'org.kde.screensaver'
    dbus-send \
        --session \
        --dest=org.freedesktop.DBus \
        --type=method_call \
        --print-reply \
        /org/freedesktop/DBus org.freedesktop.DBus.ListNames \
    | grep -o '[^"]*.screensaver'

#prints out, among other things;
#method bool org.freedesktop.ScreenSaver.SetActive(bool e)
#transform it to 'org.freedesktop.ScreenSaver'
    qdbus \
        $service /ScreenSaver \
    | grep -oP '[^ ]*(?=.SetActive)'


#monitor it with a while loop
dbus-monitor "type='signal',interface='$interface',member='ActiveChanged',path='$path'" \
| while read -r line; do
    #ignore the metadata and pull the 'boolean <true/false>' line
    read line

    #check if it is set to true
    if echo $line | grep -q 'true'; then
        echo "Locked at $(date)"
        echo "Unlocked at $(date)"

This ran fine on my Fedora with KDE, but I guess it should work on other things like Debian with gnome et cetera.
You may have issues if your grep doesn't support -P (in which case you can just use sed).

| improve this answer | |

Might as well answer this although it's not my answer (my boss provided me with the solution) to help others with the same need (or curious minds).

tl;dr: Use D-Bus to get lockscreen's actived/deactived signals.

It seems D-Bus messaging is widely supported by GNOME apps, and the ScreenSaver app specifically, and it seems that the gnome-screensaver app is the official locking app for Gnome shell.

So, to test it out, I just ran dbus-monitor and get the response:

dbus-monitor --session "type='signal',interface='org.gnome.ScreenSaver'"

I've written a little python script to log this activity into a file:

#!/usr/bin/env python
from datetime import datetime
import os
import pwd
import subprocess
import time

LOG_FILE = os.path.expanduser('~/hours_log.csv')

cmd = subprocess.Popen(["dbus-monitor \"type='signal',interface="
                        "'org.gnome.ScreenSaver'\""], shell=True,

running = 0
while 1:
    if running:
        output = cmd.stdout.readline()
        status = 'unlocked' if 'true' in output else 'locked'
        new_line = "{time} {user} {status} the screen\n".format(
        with open(LOG_FILE, 'a') as f:

        running = 0
    line = cmd.stdout.readline()
    if "ActiveChange" in line and 'org.gnome.ScreenSaver' in line:
        running = 1
| improve this answer | |
  • Polling ? what a waste of resources. – ychaouche Dec 4 '19 at 12:16

which screensaver you are using ? if it is xscreensaver, turn on the log options and try to monitor the log file.


| improve this answer | |
  • I just wrote in my own answer that the default in gnome shell is gnome-screensaver, which appears to be what I'm using (since fedora installs gnome shell by default)... – tutuDajuju Nov 2 '13 at 15:52

Linux Mint 17.1. My dbus string looks like this:

 dbus-monitor --session "type='signal',path='/org/cinnamon/ScreenSaver'" 

or it may look like this

dbus-monitor --session "type='signal',interface='org.cinnamon.ScreenSaver'"
| improve this answer | |

I'm using XFCE and XScreensaver. The dbus-monitor neither xscreensaver logging does not work for me. So I have found another solution. I hope it will be usable for other people too.

I run this command during XFCE start:

/usr/bin/xscreensaver-command -watch |logger -t lockLogger

Lock / unlock events are logged to the /var/log/messages and can be retrieved by

grep lockLogger /var/log/messages
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.