Can I find out the last time a specific USB was connected to my MBP?

Solution 1:

If your MacOS version is 10.12 and later, you can use the advanced terminal log tool.

here is how to do the same with it (if you prefer)

log show --last 35m --info --predicate 'eventMessage contains "mounted"'

here it will search for messages containing the word "mounted", but only messages of type INFO (you could change it for ERROR or omit the --info flag to search all messages)

You can change the time, on the example I used --last 35m which means only on the last 35 minutes, but you can use it like --last 4h to search the last four hours for your criteria.

Example output, click to expand it:

If you know the service subsystem, you can filter just by it, like the example below (I created the example for timeMachine subsystem, for syntax demonstration)

log show --predicate 'subsystem == "com.apple.TimeMachine" AND eventMessage contains "Failed"'

Use additional parameters like last hours, select kind of message, redirect the output to a file, etc...

The log console is very powerful and it can make queries like a database tool.

It is faster if you use the query syntax like above, but for some quick searchs you can also use 'grep', like the example below:

log show --style syslog --last 15m --info |grep '\[USB\]'

Show USB connection of my iPhone on my MacBook on the last 15 minutes: (using GREP to filter messages) and output style syslog

Statistics about the log database can be retrieved with sudo log stats (picture below) showing the date of the oldest message, date of most recent, and various other information and statistics.

Statistics (the command may take a long time to generate it, (> 5min ~ 10min)

How much data/days to store? How to customise:

1. for [MacOS 10.12 Sierra or newer] )

   • Storage parameters (such how much days to keep messages) can be changed/customised with sudo log config

see sudo log config --help or man log

2. for [MacOS El Capitan, Yosemite or older] )
   • Log settings (such as how much log data to keep stored) can be customised by editing /etc/asl.conf. Default parameters of 50MB on average gives about 7 days of stored logs.

/etc/asl.conf