Terminal Command Question

Super new to this.. Was looking to see if anyone has remotely accessed my computer, and found a site that said to paste a command into terminal to see. I've pasted the command here:


log show –last 7d –predicate ‘processImagePath CONTAINS “screensharingd” AND eventMessage CONTAINS “Authentication”‘



I learned after the fact that pasting certain commands can be dangerous. Does anyone know if the above command safe?


If it isn't, is there anything I should do?


Thank you,

MacBook Pro (2021)

Posted on May 29, 2023 8:13 PM

Reply
Question marked as Best answer

That command should be benign, and is an attempt to scan a logfile for certain data from the past week.


For command details and syntax, see:


man log


I’d also use && and not AND for the command. (Best follow the examples in the log command documentation.)


And be aware that various text-related tools will insert or will provide angled quotes and angled double-quotes, when shells usually want the vertical quotes and vertical double quotes characters. Not the angled characters.

Posted on May 29, 2023 9:31 PM

Similar questions

4 replies
Question marked as Best answer

May 29, 2023 9:31 PM in response to JustWondering1988

That command should be benign, and is an attempt to scan a logfile for certain data from the past week.


For command details and syntax, see:


man log


I’d also use && and not AND for the command. (Best follow the examples in the log command documentation.)


And be aware that various text-related tools will insert or will provide angled quotes and angled double-quotes, when shells usually want the vertical quotes and vertical double quotes characters. Not the angled characters.

May 29, 2023 10:04 PM in response to MrHoffman

Thanks so much for the reply, MrHoffman. Really appreciate it.


Nice to know that it's benign, as I copied it from a random site thinking it was some kind of official resource, and couldn't find anything about the legitimacy about the site afterwards.


This would've bothered me all day, so thank you for taking your time to help out.


G

May 30, 2023 7:04 PM in response to rileyxrose

rileyxrose wrote:

I don’t know much but I would be really really careful if I were you not everyone knows what there doing do everything you can do to avoid putting yourself information out for others to use


When that concern arises (and it can), create and use a separate macOS login (preferably without admin access), and avoid using sudo in either login. That isolates damage to the current login. Have backups of your data too, as current and complete backups are the ~only way to mark data as being valuable.

Terminal Command Question

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.