檢查 MacOS 有沒有發生解除鎖定事件

detect_unlock.py

'''
log show --style syslog \
    --start "2018-12-26 18:00:00" \
    --predicate 'process == "loginwindow"' \
    | grep 'unlock'
'''

import os
import time
import datetime

INTERVAL = 3

def unlock_detected():
    start = datetime.datetime.fromtimestamp(time.time() - INTERVAL - 1).strftime('%Y-%m-%d %H:%M:%S')
    cmd = 'log show --style syslog --start "{}" --predicate \'process == "loginwindow"\''.format(start)
    kw = 'Attempting to unlock login keychain'
    pf = os.popen(cmd)
    line = 'fuck'
    while line != '':
        line = pf.readline()
        if kw in line:
            print(line, end='')
    pf.close()

if __name__ == '__main__':
    while True:
        unlock_detected()
        time.sleep(INTERVAL)