your mac // logs everything you do

your mac remembers everything you open, and that's actually good news

most people think of logs as something for it admins or hackers in movies. but on macos, there's this thing called the unified log, and it quietly tracks an insane amount of activity on your machine. app launches, system events, network changes, all of it, timestamped. if you've never looked at it, you're sitting on a forensic goldmine you didn't know existed. let's use it to actually see what's been running on your own machine.

the command

log show --last 1h --predicate 'eventMessage CONTAINS "LAUNCH"' | tail -3

breaking this down piece by piece:

log show is the built-in macos tool for reading the unified log. it's been on every mac since el capitan, no install needed.

--last 1h tells it to only pull entries from the past hour. you can swap this for 30m, 24h, 7d, whatever window you actually care about.

--predicate 'eventMessage CONTAINS "LAUNCH"' is a filter. the unified log is massive, thousands of lines a minute, so this narrows it down to entries where the message text mentions "launch," which is a decent proxy for app launch events.

| tail -3 just grabs the last 3 results so your terminal doesn't get buried. bump that number up if you want more history.

why this matters for defense

this isn't about spying on yourself. it's about answering a question every defender should be able to answer: "what actually ran on this machine, and when." if you ever think something's off, a weird process eating cpu, a battery drain that doesn't make sense, a friend or family member says "hey did you install this," this log is your first stop before you start guessing.

it's also how you catch persistence mechanisms. malware and sketchy apps love to auto-launch themselves quietly in the background. if you check this log regularly and something's launching that you don't recognize, that's your cue to go investigate before it becomes a bigger problem.

widen your search when something looks off

if you find a suspicious launch, don't stop at the timestamp. run a broader query around that time window to see what else happened:

log show --start "2024-01-15 14:00:00" --end "2024-01-15 14:10:00" --predicate 'eventMessage CONTAINS "process"'

this gives you context. was there a network connection right before it? did another app spawn it? the unified log ties events together if you're willing to dig, and that's exactly what you want when you're trying to reconstruct what happened on a machine.

make this part of your routine, not a one-time thing

the real value here isn't running this command once for fun, it's building the habit of checking it. a few ways to actually use this:

run it weekly and skim for anything unfamiliar. most of it will be boring stuff you already know about, finder, safari, whatever. that's fine, you're building a baseline of "normal" for your own system.

if you ever hand your laptop to someone, lend it, or get it back from a repair shop, this is a fast way to check what ran while it was out of your hands.

pair it with checking your login items and launch agents (ls ~/Library/LaunchAgents and /Library/LaunchAgents) since those are the usual spots persistence hides.

the takeaway

you don't need fancy edr software to start understanding your own machine, macos already ships with a full activity log built in, most people just never open it. spend ten minutes learning this command, run it when something feels off, and you'll catch weirdness way faster than waiting for a slowdown to force your hand. save this one, you'll want it the next time something on your mac doesn't add up.