RE: OS/X Thumb drive activity logger

"Paul Melson" <[email protected]> Mon, 2 Jun 2008 13:09:15 -0400

Newsgroups	gmane.comp.sysutils.loganalysis
Message-ID	<[email protected]>

> I could not find a tool that logs USB drive activity on OS/X so I put
together another 'poor mans solution' using syslog.

Parsing /var/log/system.log for 'fseventsd' should show you all USB drive
mount events:

$ grep fseventsd /var/log/system.log
Jun  2 13:01:15 mini2 fseventsd[39]: log dir: /Volumes/NO NAME/.fseventsd
getting new uuid: 6C2D7881-D24A-424B-A3C0-32C32A403047


PaulM