Check sudo history on your Mac

What sudo is, and why its history matters

sudo lets an administrator run a single command as the root user, the account that can change anything on the Mac outside System Integrity Protection. You type it yourself in Terminal, and setup scripts and developer tools often run it after asking for your password.

That makes the sudo history a useful record. If you didn't run any admin commands this month and the list isn't empty, something else did, perhaps a script you pasted from a web page, or an installer that did more than it said. If you did, it is a quick way to remember what a setup script changed.

How to check sudo history on a Mac

macOS doesn't keep a sudo history file of its own. Each use is written to the unified system log, and you can search it in Terminal with:

log show --predicate 'process == "sudo"' --last 30d

The output is long and mixes in other messages from sudo. Sudo Activity runs that same search for you and picks out the lines that record a command, then shows each one with its date and the full command that was run, such as /usr/bin/whoami or an installer's script. The ten most recent entries are shown, newest first. If the log has no sudo commands in the last 30 days, the page says so.

When the log can't be read

An empty list and an unreadable log are not the same thing, and the page keeps them apart. If macOS refuses or fails to read the log, Sudo Activity says Sudo history unavailable with the reason, rather than reporting that there was no activity.

What it doesn't cover

Sudo Activity shows commands run through sudo. It doesn't list the times you typed your password into a macOS dialog to approve an installer or a change in System Settings, which macOS handles without sudo. For a picture of what has the deepest access to your Mac, look at Privacy Access for apps with Full Disk Access or Accessibility, and at Startup Items for what starts at login.

Read on your Mac