How to track when users log on in OS X
If you have a system that you allow other people to use, you may at times want to be able to see when others have logged in to your system. Here is one way to do this in OS X.
If you have a system that you allow other people to use, you may at times want to be able to see when others have logged into your system. This may be particularly true with systems you use as a server, a workstation at a school, or even a family computer that may have multiple accounts on it. Though the system has tools like the Console or Activity Monitor, which can show information about users on the system, using these to track when they logged in can be a bit cumbersome.
To view this information specifically, the terminal has a great utility called "last," which is very straightforward and easy to use. Just open a Terminal window and enter the command "last," and the system will list off the last time various users have logged in to the system, be it through the log-in window or through the Terminal itself.
The output will list each log-in event as the username used, followed by the log-in type, host name, log-in date, start time, end time, and session duration. The list will be in chronological order starting with the most recent, so you will have to scroll to the top of the Terminal where you entered the command in order to see the most recent log-ins.
Besides the times and durations of the log-in events, the main things to look for in the output are the events that begin with "tty" as the log-in type, versus those that say "console." The tty log-ins are from when someone used the Terminal to access the system, either locally or remotely via the "ssh" command. This means that any time you open a Terminal window, the system technically logs it as a "tty" event (stands for TeleType, which stems from the use of teletype terminals used in the mid 1900s). When an entry says "console," then the user logged in using the log-in window.
Keep in mind that while the "last" command will show log-in sessions, it will not show sharing sessions such as that for file sharing, printer sharing, or screen sharing. Nevertheless, it may be useful if you need to determine when people have accessed a particular system.
Questions? Comments? Have a fix? Post them below or e-mail us!
Be sure to check us out on Twitter and the CNET Mac forums.