Terminal Command Question

Super new to this.. Was looking to see if anyone has remotely accessed my computer, and found a site that said to paste a command into terminal to see. I've pasted the command here:


log show –last 7d –predicate ‘processImagePath CONTAINS “screensharingd” AND eventMessage CONTAINS “Authentication”‘



I learned after the fact that pasting certain commands can be dangerous. Does anyone know if the above command safe?


If it isn't, is there anything I should do?


Thank you,

MacBook Pro (2021)

Posted on May 29, 2023 8:13 PM

Reply
Question marked as Top-ranking reply

Posted on May 29, 2023 9:31 PM

That command should be benign, and is an attempt to scan a logfile for certain data from the past week.


For command details and syntax, see:


man log


I’d also use && and not AND for the command. (Best follow the examples in the log command documentation.)


And be aware that various text-related tools will insert or will provide angled quotes and angled double-quotes, when shells usually want the vertical quotes and vertical double quotes characters. Not the angled characters.

4 replies
Question marked as Top-ranking reply

May 29, 2023 9:31 PM in response to JustWondering1988

That command should be benign, and is an attempt to scan a logfile for certain data from the past week.


For command details and syntax, see:


man log


I’d also use && and not AND for the command. (Best follow the examples in the log command documentation.)


And be aware that various text-related tools will insert or will provide angled quotes and angled double-quotes, when shells usually want the vertical quotes and vertical double quotes characters. Not the angled characters.

May 30, 2023 7:04 PM in response to rileyxrose

rileyxrose wrote:

I don’t know much but I would be really really careful if I were you not everyone knows what there doing do everything you can do to avoid putting yourself information out for others to use


When that concern arises (and it can), create and use a separate macOS login (preferably without admin access), and avoid using sudo in either login. That isolates damage to the current login. Have backups of your data too, as current and complete backups are the ~only way to mark data as being valuable.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Terminal Command Question

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.