Is there a log of activity on OS X?

January 15, 2007 3:41 AM

Mac OS X - is there some sort of log on an iBook's hard drive showing when the machine was booted up and shut down, over the previous few weeks? The reason I ask is that I'm in the middle of a weird Ebay tussle.

I sold my old iBook on Ebay, it was in perfect working order. I then got an email from the purchaser saying that he was unable to boot it, and that it was a dodgy hard drive. I agreed to let him send it back to me and I'd fix it.
I eventually got the machine back, and it works perfectly. In fact, it has clearly been used.
I emailed back saying it works fine and pointed out that it has been used, so his assertion that it can't be booted was clearly wrong, and that if he Paypal'd me the postage, I would return it.
Anyway, he then said that it booted occasionally but was intermittent and that "he doesn't want his money back, he just wants a working machine."
Anyway, that's all a bit of weird background. I was wondering if there was anyway I could tell from the logs on the machine the usage over the last few weeks, so that I would be in a better position to go back to him and tell him to stop messing me about?

posted by chill to computers & internet (6 comments total)

off the top of my head how about checking the history in things like safari.

searching for files created between a certain time frame.

im afraid i dont know enough about OS X to give you a definitive answer though
posted by moochoo at 3:45 AM on January 15, 2007

The unix command "last" will read the contents of /var/log/wtmp which contains details of login / out events and system startup / shutdown times. Bring up a shell (Applications->Utilities->Terminal) and type "last" at the prompt (followed by the enter key...)
posted by pharm at 3:54 AM on January 15, 2007 [2 favorites]

i just found the last command also [did a bit of googling]

http://www.macosxhints.com/article.php?story=20010626215103565

if you scroll down has a few scripts you could run
posted by moochoo at 3:55 AM on January 15, 2007

/var/log/system.log

There are also .gz'ed archives of the last several logs, in the same directory. Something similar to this is the beginning of a system boot:

Dec 31 17:06:18 localhost kernel[0]: standard timeslicing quantum is 10000 us
Dec 31 17:06:16 localhost mDNSResponder-107 (Mar 20 2005 20: 31:47)[76]: starting
Dec 31 17:06:18 localhost kernel[0]: vm_page_bootstrap: 122648 free pages
Dec 31 17:06:17 localhost DirectoryService[74]: Launched version 1.8 (v346)
Dec 31 17:06:18 localhost kernel[0]: mig_table_max_displ = 70
Dec 31 17:06:18 localhost kernel[0]: MacRISC4CPU::start - found 'cy28508'
Dec 31 17:06:18 localhost kernel[0]: Copyright (c) 1982, 1986, 1989, 1991, 1993
Dec 31 17:06:18 localhost kernel[0]: The Regents of the University of California. All rights reserved.

You should note, however, that these files can be altered by hand if an administrator wishes to do so, and are not concrete "evidence" of anything.
posted by Mikey-San at 4:01 AM on January 15, 2007

Console (Utilities folder) puts a 'friendly' face on logs if you don't want to muck around in the Terminal. Be sure to check system.log as well as console.log.

More info here.
posted by O9scar at 5:16 AM on January 15, 2007

Excellent, thanks all, I'll give those a go tonight.
posted by chill at 5:42 AM on January 15, 2007