Can system logs tell me when I closed my Macbook?

Question

I'm trying to figure out how late I've been working for the last few months.

Normally my old line manager would not have given me time in lieu. However she was fired last week and I now stand a chance of getting some time back from the company.

The best measurement of when I stop work is when I last close my macbook each day. Could I find this out from the sys logs?

Answer 1

So the closest answer I could get was this console command:

log show -v | grep "Entering Sleep state due to 'Clamshell Sleep'"

It's not perfect as it only goes back 6 weeks or so, and it shows more sleep messages than I need. But from the results set, its easy to pick out the last 'System Sleep' of the day.

Answer 2

The last message before I opened my MacBook this morning was

5/19/19 22:43:36.000 kernel[0]: AirPort_Brcm43xx::powerChange: System Sleep 

I'm not sure I closed it at that time exactly last night but it was close.

I've just run an experiment now and it took about 15 seconds from my last activity before I close the lid until that message appears.

Answer 3

After a quick bit of research, this may be worth a try. Open a terminal window to get the bash prompt, then:

$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --last 24h

I've included the --last 24h option so that you won't be inundated with data. Use this first to confirm that this will give you the data you need. If you may want to experiment with different predicate options, etc you can read all about it at man log.

I don't know how far back the system logs go on your system, so this will avoid a huge dump to your terminal. But of course if you don't mind a huge dump to your terminal, simply remove that option from the command line. Based on a previous answer here at "AskDifferent" the period of time that your logs will cover is apparently a function of some settings in the /etc/asl.conf file. That answer has a method to check & adjust those settings. However, in looking at my own asl.conf file, it differs some from the settings in the referenced answer (e.g. there is no ttl limit in my asl.conf). And so, you may not know how far back you can go until you actually try. If the entire period of interest isn't in the logs, I don't have any ideas, except to increase the log limits in asl.conf to avoid that issue in the future, or perhaps set up log rotation.

A couple of other points:

1. If you don't use sudo, you may get the following odd error message:

log: Could not open local log store: The log archive format is corrupt and cannot be read

That message is likely false and misleading; use sudo, and it should disappear (unless your logs truly are corrupted!).

2. If you want to save the log output to a file, that's easy enough:

$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --last 24h >> ~/MyClamshellClosures.txt 

3. And finally, if you want to see log entries for a range of dates, e.g. YTD:

$ sudo log show --predicate 'eventMessage contains "Clamshell change detected"' --start "2019-01-01" --end "2019-05-19" >> ~/MyClamshellClosures.txt 

ALTERNATIVELY:

If you don't wish to use the command line, the Console app in Launchpad, Other may also be used. I prefer the command line, but there are some decent and current tutorials that may help:

1. Fm 'techbland.com', May 15, 2019

2. Fm 'howtogeek.com', Mar 19, 2019