Can system logs tell me when I closed my Macbook?
I'm trying to figure out how late I've been working for the last few months.
Normally my old line manager would not have given me time in lieu. However she was fired last week and I now stand a chance of getting some time back from the company.
The best measurement of when I stop work is when I last close my macbook each day. Could I find this out from the sys logs?
Solution 1:
The last message before I opened my MacBook this morning was
5/19/19 22:43:36.000 kernel[0]: AirPort_Brcm43xx::powerChange: System Sleep
I'm not sure I closed it at that time exactly last night but it was close.
I've just run an experiment now and it took about 15 seconds from my last activity before I close the lid until that message appears.
Solution 2:
After a quick bit of research, this may be worth a try. Open a terminal window to get the bash
prompt, then:
$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --last 24h
I've included the --last 24h
option so that you won't be inundated with data. Use this first to confirm that this will give you the data you need. If you may want to experiment with different predicate
options, etc you can read all about it at man log
.
I don't know how far back the system logs go on your system, so this will avoid a huge dump to your terminal. But of course if you don't mind a huge dump to your terminal, simply remove that option from the command line. Based on a previous answer here at "AskDifferent" the period of time that your logs will cover is apparently a function of some settings in the /etc/asl.conf
file. That answer has a method to check & adjust those settings. However, in looking at my own asl.conf
file, it differs some from the settings in the referenced answer (e.g. there is no ttl
limit in my asl.conf
). And so, you may not know how far back you can go until you actually try. If the entire period of interest isn't in the logs, I don't have any ideas, except to increase the log limits in asl.conf
to avoid that issue in the future, or perhaps set up log rotation.
A couple of other points:
- If you don't use
sudo
, you may get the following odd error message:
log: Could not open local log store: The log archive format is corrupt and cannot be read
That message is likely false and misleading; use sudo
, and it should disappear (unless your logs truly are corrupted!).
- If you want to save the
log
output to a file, that's easy enough:
$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --last 24h >> ~/MyClamshellClosures.txt
- And finally, if you want to see log entries for a range of dates, e.g. YTD:
$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --start "2019-01-01" --end "2019-05-19" >> ~/MyClamshellClosures.txt
ALTERNATIVELY:
If you don't wish to use the command line, the Console
app in Launchpad
, Other
may also be used. I prefer the command line, but there are some decent and current tutorials that may help:
Fm 'techbland.com', May 15, 2019
Fm 'howtogeek.com', Mar 19, 2019
Solution 3:
So the closest answer I could get was this console command:
log show -v | grep "Entering Sleep state due to 'Clamshell Sleep'"
It's not perfect as it only goes back 6 weeks or so, and it shows more sleep messages than I need. But from the results set, its easy to pick out the last 'System Sleep' of the day.