Foreign access to my MacBook

[retta283]

I'd check Protokollberichte. If my understanding of German is correct that means Logs, which is what you're after. If you can't find that info in there, or under any of the menubar options, then it's likely that Apple has dumbed down the Console app and removed the function to see all system logs under one view.

 

[Nicole133]

Here I cannot find the 29.December 20
At Terminal it“s there.

 

[retta283]

It's probably another case of Apple removing features from their built-in apps, total shame because that one was very useful in determining causes of repeated crashes or other issues. At least Terminal shows something.

 

[Nicole133]

Yes, but is it write that Terminal distinguishes between the logins which ended with a shutdown of the Mac and those which ended with a mere closing the cover?
If I have interpreted in the right way, every login which ended with a shutdown shows a bracket with the time working with the Mac and every login which ended with a mere close has a 0 in the bracket and the note „still logged in“

Is that right how I interprete it?

 

[Nicole133]

Could you please check it, if I am right with my supposal that my Macbook was shutdown on 29 th. Dec. 20?
I mean, if I have shut it down, how could it be running the next time I have opened it on 13. January 21?
There are just two causes:
• My interpretion of the Terminal „last“ login history is wrong OR
• Somebody has oppened and logged in the meantime

 

[Nicole133]

Thank you but thats not my initial problem. I have to know if somebody has taken access to my Mac on 1th January. I dont“t understand why that is so uncredible difficult to find out. Normally computers should store this information anywhere or not?

 

[hwojtek]

All my passwords! have been stored on that iphone in the notes App.

You do realize MacOS uses Keychain Access for protected password storage and secure notes inside of it if you really need to store them as a note just to protect you from doing exactly what you did wrong?

Anyway, this may help https://unix.stackexchange.com/ques...gged-into-the-system-under-mac-os-x-last-is-n

Enter system.log and use console search to look for loginwindow:

Jan 15 21:05:50 Wojteks-Mac-Pro com.apple.xpc.launchd[1] (com.apple.UserEventAgent-LoginWindow): This service is defined to be constantly running and is inherently inefficient.

In the above example it shows I logged on manually to my Mac Pro at 8:05.50 PM tonight (and the loginwindow service started its inherently inefficient execution which will end in it shutting down all running apps and getting killed by kernel once I log out. Note: the timestamp in the log is UTC).

 

[Nicole133]

Thank you very much for the hint! I will check it as soon as I have sol