how to see logs for a particular date

Question

Level 1

121 points

how to see logs for a particular date

Twice now, I've shut down my computer before I go out of town. Upon returning, the computer is running again, no error messages saying it attempted to shut down but couldn't. It's like somebody turned it on, but there was no one home to do that. I would like to access the logs to show when it was turned on and perhaps how, but I'm unable to access a search for the logs for a particular date. Any thoughts on any of these mysteries?

Thanks

iMac, iOS 9, 21.5 late 2013

Posted on Aug 22, 2017 9:15 PM

Reply

Answer 1

VikingOSX

Level 10

123,398 points

Aug 23, 2017 11:13 AM in response to Buffsters

The first two things that come to mind is 1) you have scheduled a startup/wake time in System Preferences : Energy Saver : Schedule... — and forgot about it, or someone else has indeed, physically accessed the Mac while you were away.

System logs on OS X are eventually rotated, and new ones started. If needed, this process will occur when you first boot the Mac in the morning. The current, and three preceding system logs are kept. You can view these in the Launchpad : Other : Console application.

Scroll down the left panel of the Console app until you encounter system.log, system.log.0.gz, etc. When you click on these, you will see all logged System activity including boot sequences. The time stamps are on the left, and the most current for the log is at the bottom.

Reply

Answer 2

Buffsters Author

Level 1

121 points

Aug 23, 2017 11:15 AM in response to VikingOSX

I saw the log activity, but it is all for the current day. I left on 8/19, computer off, and returned on 8/22 and the computer is on. I need to know when it was restarted, so that I can determine whether it was an app or a person who turned the computer back on. The time that this happened would be crucial in understanding what's happening.

Thanks in advance...

Reply

Answer 3

VikingOSX

Level 10

123,398 points

Aug 23, 2017 2:48 PM in response to Buffsters

My system.log.2.gz has date/time stamps for Aug 19, and that dates activity spills over into sys.log.1.gz. Look at that log in the Console. Also, you can get a list of users and date/time stamp of system usage in the Terminal app:

last | more

Mine shows activity from June 9 thu Aug 23, so you should see something there about account usage for Aug 19.

Reply