Apple unified Logs
Has any one worked with AUL
(Apple Unified Logs)
iPhone 14, iOS 17
Question marked as
If you do an Internet search on Apple Unified Logging, you will find dozens of articles both about what this is, and a number of techniques on how to parse them for the data you are looking for. The learning curve is a bit steep, but it is manageable. It depends on how much effort you want to spend.
If you are looking for a "quick" answer, that may be somewhat difficult as it will require that you perform a number of steps that you may not be familiar with, including entering commands in the Terminal app.
For example, if you enter the following command:
log show --predicate 'eventMessage contains "SessionAgentNotificationCenter"'
You will get a listing of the following types of events:
- Screen Lock/Unlock Status
- User Logons
- User Logoff
- Restarts (w/UID)
- Shutdown (w/UID)
- Fast User Switching
- Canceled Restart/Shutdown/Logoff
If you want to know how they logged in. That is via the password window, Touch ID, or by using an Apple Watch, then you would want to use this command:
log show --predicate 'eventMessage contains "LWScreenLockAuthentication" and (eventMessage contains "| Verifying" or eventMessage contains "| Using")'
What you would look for are the following events messages:
Regular Password:
- “Verifying using PAM configuration screensaver”
TouchID:
- “Using localAuthentication hints”
- “Using hint-provided username oompa”
- “Verifying using PAM configuration screensaver_la”
Auto Unlock with Apple Watch:
- “Using continuity hints”
- “Using hint-provided username oompa”
- “Verifying using PAM configuration screensaver_aks”