Mac OS, how to find out which user logged into the system in a period of time:

Mac OS, how to find out which user logged into the system in a period of time:

log show –predicate ‚(eventMessage CONTAINS „password was supplied“)‘ –style syslog –last 7d

succesfull logins in a anonym list:

Timestamp                       (process)[PID]    

2018-09-12 12:57:04.532409+0200  localhost loginwindow[119]: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin result: 0, password was supplied

2018-09-18 08:33:08.519486+0200  localhost loginwindow[119]: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin result: 0, password was supplied

2018-09-19 07:46:46.485942+0200  localhost loginwindow[119]: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin result: 0, password was supplied

more details:

log show –predicate ‚(eventMessage CONTAINS „Login“)‘ –style syslog –last 7d

Timestamp                       (process)[PID]    

2018-09-19 07:46:46.485942+0200  localhost loginwindow[119]: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin result: 0, password was supplied

2018-09-19 07:46:50.637471+0200  localhost com.apple.iCloudHelper[48889]: (AOSKit) AOSKit INFO: (com.apple.AOSPushRelay/1.07) ACCT UPDATE: Will attempt account save for account name (gotStore=1)