VNC / Screensharing log

[McArenas]

Hi there team... when someone remotes in either via VNC, Screen sharing or ARD, which particular log file is touch[ed] on the target's computer?

Vice versa, will there be a log on the viewer side regardless if the attempt is successful or not.

I know "last" will display logins via console or terminal, is there any helpful terminal command to get this info?

thanks,
M

[MAD0oM]

@McArenas I'd think it would be the System.log file on the machine. Searching via console "login" or "failed" should get some info. Also for terminal i'd use this command "syslog -F raw -k Facility com.apple.system.lastlog | grep Username" if you want to get every info leave out the grep. hopefully this helps.

[mm2270]

I don't think there is a discrete Screen Sharing log, but as @MAD0oM mentioned, some information about Screen Sharing will get stored in the system.log. Only issue is, if you planned on grabbing this information into an Extension Attribute or collecting it with a periodic policy/script, the system.log gets rotated fairly quickly due to the amount of information that gets written to it, so stuff will fall out of range of any scripts picking that up pretty fast.

Another option would be to look at the process I put together here. Once its installed, a new log gets created that captures information on Screen Sharing sessions, including any connecting host info and/or usernames, the type of screen sharing session and an approx length of time the screen sharing happened. Read thru the Readme page for more information.

[McArenas]

Thank you @MAD0oM and @mm2270 ! Truly appreciate your replies.