0

In Windows I used a Windows-exclusive program called USBLogView to check USB devices for loose connections. USBLogView provides an overview over all plug and unplug events for USB devices. Say you have a USB device connected event at 13:37:00 and a disconnect event at 13:45:10 followed by a reconnect event at 13:45:13. This would be a clear indication of a USB device with a loose connection. In Windows you additionally could identify USB devices with loose connections based on sound notifications.

I recently switched to a Mac mini with an M1 and have not found a way to replace USBLogView. Addtionally MacOS seems to not offer the option to play a sound notification for USB devices being disconnected/connected. I know I can access an overview of all USB devices connected to my Mac under «About this Mac», «System Report...», «USB». However that overview does not even react when I manually disconnect a USB device. I also know that using the terminal command ioreg -p IOUSB lists all currently connected USB devices as well, but it does so without providing time stamps and thus it is not possible to deduce whether there has been a disconnect or not.

I also tried using the Console, as explained in this StackExchange thread. However upon selecting system.log in the Console, and then searching for «USBMSC» I just get zero results.

I found a StackExchange thread in which someone stated the following: «Unfortunately peripheral connections are simply something that isn't logged by your Mac.» Is this really true? Or is there a way to check when a USB device was connected/disconnected in MacOS?

ComprehensiveGoose
  • 3

1 Answers1

2

One way of doing it is by using the unified logging system.

As the data you're looking for is probably the low-level kernel events, they're typically marked as "private" in the log (i.e. they're not shown). So you'll first have to enable showing private log data:

Start by creating a file name "private.mobileconfig" containing the following:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadDisplayName</key>
      <string>ManagedClient logging</string>
      <key>PayloadEnabled</key>
      <true/>
      <key>PayloadIdentifier</key>
      <string>com.apple.logging.ManagedClient.1</string>
      <key>PayloadType</key>
      <string>com.apple.system.logging</string>
      <key>PayloadUUID</key>
      <string>ED5DE307-A5FC-434F-AD88-187677F02222</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>System</key>
      <dict>
        <key>Enable-Private-Data</key>
        <true/>
      </dict>
    </dict>
  </array>
  <key>PayloadDescription</key>
  <string>Enable Unified Log Private Data logging</string>
  <key>PayloadDisplayName</key>
  <string>Enable Unified Log Private Data</string>
  <key>PayloadIdentifier</key>
  <string>C510208B-AD6E-4121-A945-E397B61CACCF</string>
  <key>PayloadRemovalDisallowed</key>
  <false/>
  <key>PayloadScope</key>
  <string>System</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>D30C25BD-E0C1-44C8-830A-964F27DAD4BA</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Double-click the file and you'll be asked to confirm installing the profile. Accept that - it can always be removed when you're done looking at the USB events.

Now you have the profile installed, you can open a Terminal and run:

log stream

You'll see all events stream by, and you can then add predicates to show only the ones you're interested in.

You can also use a simpler method like so:

log stream | grep -i usb

in order to only display log messages containing the word "usb".

Depending on the type of USB device you're interested in, the messages when connecting and disconnecting will look differently. For example a mouse will generate HID events, whereas an SSD will generate mass storage device events.

jksoegaard
  • 77,783