Use the following command to filter system logs for entries related to logouts:
This command uses the log command to show entries that include the term “logout.” The –predicate option filters the logs based on the specified query, and –info includes info-level messages.
log show --predicate 'eventMessage contains "logout"' --info
Time Constraints: If you know the approximate time of the unexpected logout, you can narrow down the log entries by adding –start and –end options with timestamps, like this:
log show --start "2023-12-27 12:00:00" --end "2023-12-27 13:00:00" --predicate 'eventMessage contains "logout"' --info
Exporting Logs: If the logs are lengthy or you want to analyze them more comfortably, you can redirect the output to a file:
log show --predicate 'eventMessage contains "logout"' --info > ~/Desktop/LogoutLogs.txt
Viewing All Logs: If you’re not sure what you’re looking for, you can view a broader set of logs and then search through them manually:
log show --info | grep -i "logout"
