How do I track Apple Remote Desktop connections on a client?

I need to track when an Apple Remote Desktop connection is made on a client.


If I go to my client's Console, select the computer's name in the upper left corner, and enter the search term "screensharingd", I get:

Great! I see my Apple Remote Desktop connections with time, user name, and IP address. However, I'm seeing only the most recent log activities. This is not usually any more than 12 hours old as all logs are gzip away.


But now I want to look in the .gz files for past history:

zgrep -ri screensharingd /private/var/log/*.*

Unfortunately, there are no search results for screensharingd.


Even if I "grep -i screensharingd /private/var/log/system.log" my log file, nothing shows!


I have searched all over my computer's log files and can't find what I see in the Console.


First question: In what file does the Console data reside that shows the result in the picture above?


Second more generic question: Does anyone know where the history of screensharingd connections are logged?


FYI: Our computers are still on MacOS X.12.x.


Rob

Posted on Jan 23, 2019 6:32 PM

Reply

There are no replies.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How do I track Apple Remote Desktop connections on a client?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.