List of all dates+times when I used my MacBook?

I need a list of the periods of times I used my MacBook throughout the last 30 days.

It would be sufficient to have a list of all lid-open and lid-close datetimes (because I close the lid whenever I don't use the MacBook). A chronological list of all sleep / wakeup / poweroff / poweron (and maybe login) datetimes would help as well.

What didn't help:

• Googling
• The last command
• Filtering /var/log/system.log (which btw only contains one day)
• Filtering the console app (but maybe there's a way...)

Solution 1:

If it is sufficient to have a list of all sleep/wake cycles (lid-open, lid-close), you can run:

pmset -g log | grep ' Wake '

or

pmset -g log | grep ' sleep '

Play around with the string passed to grep to get the information that you need.

Solution 2:

I looked at this a bit and it seems doable, but you'll need to look at your behaviour with the system over time to determine exactly what messages in the logs to grep. I did the following set of steps to analyze the full history of sleep/wake cycles for this MacBook and it goes back all the way to Aug 12.

Preconditions: Writing to non-root user into ~/Downloads. Change paths and output filenames as desired.

#!/bin/bash
#
# Read system wake/sleep cycles from kernel logs from oldest to newest.
#
# First, read the archived kernel logs for wakes.
for file in $(ls -r /var/log/kernel.log.*) ; do   bunzip2 -c $file | grep 'Wake reason:' >> ~/Downloads/wakeup.txt; done
#
# Read current kernel.log for wakes.
grep 'Wake reason:' /var/log/kernel.log >> ~/Downloads/wakeup.txt
#
# Read archived kernel logs for sleeps.
for file in $(ls -r /var/log/kernel.log.*) ; do   bunzip2 -c $file | grep ': sleep' >> ~/Downloads/wakeup.txt; done
#
# Read current kernel.log for sleeps.
grep ': sleep' /var/log/kernel.log >> ~/Downloads/wakeup.txt
#
# Sort raw output from greps for chronological picture.
sort -o ~/Downloads/sortedwake.txt ~/Downloads/wakeup.txt

That should give you a decent jump on arriving at a more complete picture. You can examine the kernel logs to let you know when the system was rebooted, etc. Once you know what to filter on, you'll be able to expand on this quite a bit. Have fun with it.

Oh, one final note: If you're examining a system that visits many networks, you'll see your system name changing in the logs according to what the DNS server associates with your IP address. It looks a little odd, but it's quite normal behaviour.