Jump to content
Sign in to follow this  
davejacko

Startup log, History of times?

Recommended Posts

Hey,

I was wondering if anyone knows is there is a way of getting a list of the startup and shutdown times in Leopard. I have a sneaking suspicion someone who has my password is snooping around my Mac when i am not there. I noticed this by looking at recent files in Pages that I haven't opened in months.

Share this post


Link to post
Share on other sites

you could try making an Automator workflow or something that runs a terminal script like

date >> /Users/Yourusername/.loginlog.txt

and set that to run as a login item.

 

That would make a hidden file that just displays the date and time of any login. You could view it by opening terminal and running "open ~/.loginlog.txt".

 

Im sure theres a better way, but thats just a quick and dirty one off the top of my head.

Share this post


Link to post
Share on other sites

When OS X boots, some distinctive info is written to /var/log/system.log. E.g.:

Jan 18 15:01:37 localhost kernel[0]: PAE enabled
Jan 18 15:01:37 localhost kernel[0]: 64 bit mode enabled
Jan 18 15:01:37 localhost kernel[0]: Darwin Kernel Version 9.1.0: Wed Oct 31 17:46:22 PDT 2007; root:xnu-1228.0.2~1/RELEASE_I386
Jan 18 15:01:37 localhost kernel[0]: standard timeslicing quantum is 10000 us
Jan 18 15:01:37 localhost kernel[0]: vm_page_bootstrap: 972836 free pages and 75740 wired pages
Jan 18 15:01:37 localhost kernel[0]: Loading security extension com.apple.nke.applicationfirewall
Jan 18 15:01:37 localhost kernel[0]: Loading security extension com.apple.security.seatbelt
Jan 18 15:01:37 localhost kernel[0]: calling mpo_policy_init for mb
Jan 18 15:01:37 localhost kernel[0]: Seatbelt MACF policy initialized
Jan 18 15:01:38 localhost kernel[0]: Security policy loaded: Seatbelt Policy (mb)
Jan 18 15:01:38 localhost kernel[0]: Copyright © 1982, 1986, 1989, 1991, 1993
Jan 18 15:01:38 localhost kernel[0]: The Regents of the University of California. All rights reserved.

A search for "Darwin Kernel" should reveal your recent boots. Use the OS X Console utility (in your Application/utilities folder) to browse and search system.log, or via the Terminal command:

sudo grep "Darwin Kernel" /var/log/system.log

 

A login or logout (return to the login window) will produce a system.log message from loginwindow. You can search for "loginwindow" in Console or via the Terminal command:

sudo grep "loginwindow" /var/log/system.log

 

There are lots of other distinctive item in system.log when you log in, depending on how your system is set up (E.g., my log contains messages about starting vmware (for Fusion), wacom tablet driver, menumeters, and little snitch; all software that I have installed. Just look back in the log to your last known login time to see what's typical of your login, then look for unexpected occurences elsewhere.

 

Note that the system.log only covers a day. You can find zip'd copies of older logs (back 7 days) in the /var/log directory. E.g.:

 sudo ls -l system.log*
-rw-rw-rw-  1 root  admin  138655 Jan 18 15:38 system.log
-rw-r-----  1 root  admin   19828 Jan 18 00:00 system.log.0.bz2
-rw-r-----  1 root  admin   18403 Jan 17 00:00 system.log.1.bz2
-rw-r-----  1 root  admin   16279 Jan 16 00:00 system.log.2.bz2
-rw-r-----  1 root  admin   12024 Jan 15 00:00 system.log.3.bz2
-rw-r-----  1 root  admin   15843 Jan 14 00:00 system.log.4.bz2
-rw-r-----  1 root  admin   17308 Jan 13 00:00 system.log.5.bz2
-rw-r-----  1 root  admin   21072 Jan 12 00:00 system.log.6.bz2
-rw-r-----  1 root  admin   18856 Jan 11 00:02 system.log.7.bz2

Those .bz2 files can be unzip'd and grep'd, though you'll need to use the Terminal.

Share this post


Link to post
Share on other sites

I am dying to know if you were right or just paranoid. What's the outcome?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing

    No registered users viewing this page.

  • Who's Online (See full list)

    There are no registered users currently online

×