Any way to get the last times the screen was unlocked in macOS?

Solution 1:

If you go to the Console app on your Mac (it is located in Applications/ Utilities folder) and click on "Macs Analytics Data" which appears on the left side of the window. This report has a message "loginwindow" and is stamped with a time and has the word "screenlock" on the same line. I just locked and screen and then unlocked it and I got that message. You could grep out all the "loginwindow" terms and the "screenlock" terms. This should give you a list of times these events happened.

This log can be located with Finder by right-clicking it > reveal in finder (at least in macOS High Sierra)

Solution 2:

It appears different versions of macOS use different logs to repersent this. None of which, I have found, show a different log for a "login" or an "unlock". I have answered the next best thing: How to find all logins/unlocks. The following terminal commands will show you the date in time in which a login or unlock occurred.

With the help of this answer, and spending an hour looking through logs I figured this out:

P.S. You can additionally use the helpful --last tag to limit to a specific time relative to now. For example --last 5m would only be the last 5 minutes, --last 5h would be the last 5 hours, and --last 5d would be last 5 days.

macOS Mojave

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider activate]_block_invoke"

Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider activate]_block_invoke.

Check for valid unlock attempts (Valid password or Touch ID):

 log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke"

Explanation: The command will look through the logs and find ones that are from the process "loginwindow" and contain LUIAuthenticationServiceProvider deactivateWithContext:]_block_invoke.

macOS High Sierra

WIP

Check for blocked unlock attempts (Invalid password or Touch ID):

...

Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "LAClient evaluatePolicy:options:uiDelegate:reply:]_block_invoke"

macOS Sierra

Check for blocked unlock attempts (Invalid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "Verify password called with PAM auth set to YES, but pam handle == nil"

Check for valid unlock attempts (Valid password or Touch ID):

log show --style syslog --predicate 'process == "loginwindow"' --debug --info | grep "SecKeychainLogin result: 0, password was supplied"

Solution 3:

MacOS Catalina has a log format different from Mojave. Based on the answer from JBis, I wrote a script for Catalina called lockunlock.sh

#!/bin/sh
PERIOD=1d
if [[ $# -ge 1 ]]; then
    PERIOD=$1
fi
echo "Times of Mac screen lock and unlock events in the past ${PERIOD}:"
SEARCH_FOR="going inactive, create activity semaphore|releasing the activity semaphore"
log show --style syslog --predicate 'process == "loginwindow"' --debug --info --last ${PERIOD} | grep -E "${SEARCH_FOR}" | cut -c '1-32 141-155'

To arrive at the desired search term, I locked and unlocked my computer to make sure there were events, then viewed the last minute of log with

log show --style syslog --predicate 'process == "loginwindow"' --debug --info --last 1m | less