Click here to return to the 'Create a login/logout tracking log file for all users' hint |
Even if you don't, you can disable the trackpad on your Mac by turning on Mouse Keys and checking a different box in the same settings tab. Visit Business Insider's homepage for more stories. MacOS Big Sur elevates the most advanced desktop operating system in the world to a new level of power and beauty. Experience Mac to the fullest with a refined new design. Enjoy the biggest Safari update ever. Discover new features for Maps and Messages. And get even more transparency around your privacy.
I haven't studied this hint in detail, so I may be badly wrong, but couldn't you use the 'last' command in the Terminal to get this information?
Chris
What if the creators of Super Mario World, PowerPoint and even the card game Magic: The Gathering had accidentally created tools hiding a general-purpose computer in plain sight? Turing test track . In any case, the submission must be able to run on an Intel machine running either Mac OS X (preferred), Ubuntu Linux or Windows XP.
That's funny. I never knew about the last command.
Does last's log file get deleted every month during the automatic log cleaning of the system? When I check the log it only goes back to Aug 1st, but checking the log from my hint it goes back to June when I first implemented this hint. If the log is deleted every month then I think I'll stick with my solution because checking last on Aug 1st will not tell me what happened on July 31st.
You could likely change the log rolling to not change wtmp. Or, set up a cronjob to execute last and save the output into a file you own.
Last produces binary file with the permissions
-rw-r--r-- 1 root admin 19836 Aug 18 10:09 /var/log/wtmp
The root ownership and read only permissions for non-root users prevents basic abuse. While your children may be trusted to respect parental limits, and thus your script may be fine, for system administrators who need to track usage of a machine, last is very reliable. It also logs ftp, ssh, and telnet access.
'The login hook will be run as root.'
Ignore my previous comment.
Although the 'last' commands' login log gets cleaned out every once and a while, it appears that archives are stored in /var/log/wtmp.n.gz where 'n' is sequential to how many times it has been archived. Unzip the file, and use last -f <file> to view the archived log.
Thanks for the tip, it lead me to figure this out.
By having these scripts run at login and logout, I've found other uses for them too. I can add other script code to my scripts to have other things performed on my mac too.
For example, I've disabled the startup chime when my mac reboots. I added the code /usr/bin/osascript -e 'set volume 4' to the loginscript and /usr/bin/osascript -e 'set volume 0' to the logoutscript. This way my volume gets set to zero when I logout and thus the startup chime is muted, and the volume gets set to a consistent level (i.e. 4) when I boot up.
After seeing what you added, I decided to use '/usr/sbin/diskutil unmount /dev/disk0s3' in mine to unmount my Windows partition on login :D
Yes, the login/logout hooks are very powerful. There's much that can be done that you can't do with the 'login items' in the accounts preference pane.
Interested to know why everybody on your Mac logs in and out--why not use Fast User Switching?
Limiting usage to a single login session instead of using Fast User Switching can improve performance on systems with less memory.
I am not a fan of the last command because the wtmp database can become corrupted very easily. I don't know why but it it can. That is why a third party logger can be very helpful.
These kinds of things are important to me because of the kind of logging that I'm required to maintain on my systems. This problem doesn't just show up on Macs. It can show up in Solaris, Linux, IRIX and HP-UX.
Related, but a little off-topic: Is there a way to monitor file system changes? Specifically, some time ago we lost a bunch of files, which may possibly have been intentionally deleted by a malicious user. But we have not found a way to determine when and by whom the files were deleted. Does anyone know a good monitoring solution for this type of situation?
last grep '$( date cut -c5-10 )' cut -c1-10,37-75 sort
What it does: performs the last command passes the results to grep which filters all but those which match todays date passes that to the cut command which just gives me the username and start to stop times then it is sorted so each user's data is grouped together
---
--Chip
Interesting that no one said anything about the big implication with this hint: you are spying on your kids.
I don't want my employer to collect this type of data about me, why would it be ok just because the subject can't defend him-/herself?
---
http://www.google.com/search?as_q=%22Authored+by%3A+david-bo%22&num=10&hl=en&ie=ISO-8859-1&btnG=
You don't think your employer collects data about you??? Really? Anyway, as an adult maybe you don't need supervision... but kids certainly do. That's my responsibility.
Eh... pardon my ignorance, but a few things:
1. How do you create scripts?
2. My computer has no /usr/local/bin, so I have no idea how to save the script, if I knew how to make one.
3. My terminal is saying that it does not recognize a+x.
4. My terminal is saying that it does not recognize ?.
Er, sorry if these are obvious questions, but I'm not a very proficient user.
---
Phillip
'I played a blank tape on full volume. The mime who lives next door complained.' -SW
1. How do you create scripts?
In a plaintext editor like TextEdit, or my favourite TextMate. BBEdit is the other major editor but it's expensive IMO.
2. My computer has no /usr/local/bin, so I have no idea how to save the script, if I knew how to make one.
You need to be an administrator and enable root access to tinker with the contents of /usr. If you have the priveleges necessary use:
to create the necessary directories all the way down to /usr/local/bin
3. My terminal is saying that it does not recognize a+x.
Once the scripts exist in the /usr/local/bin directory use…
…to enable execution. You'll need to change loginscript to the name of your script, whatever that may be.
4. My terminal is saying that it does not recognize ?.What exactly is the response from Terminal? Is it that terminal does not recognise a question mark or are you trying to work with files that don't exist??
The errors may be due to the scripts being located somewhere other than where you're chmod'ing.
---
James