How to see Mac Login and Shutdown history for audit

If you want to audit, when your Mac (Macbook/iMac/Mac Studio/Mini) was last logged in, rebooted, or shut down, you can make use of the last command on the Terminal app. It will give a record of all such details.

Example:

Macbook % last
code2care  ttys001                         Thu Sep 14 10:58   still logged in
code2care  ttys000                         Thu Sep 14 10:58   still logged in
code2care  console                         Thu Sep 14 10:58   still logged in
reboot time                                Thu Sep 14 10:57
shutdown time                              Thu Sep 14 00:31
code2care  ttys001                         Wed Sep 13 13:26 - 13:26  (00:00)
code2care  ttys000                         Wed Sep 13 13:25 - 13:25  (00:00)
code2care  console                         Tue Sep 12 09:59 - 00:31 (1+14:31)
reboot time                                Tue Sep 12 09:58
shutdown time                              Tue Sep 12 01:22
code2care  ttys000                         Sun Sep 10 11:23 - 11:23  (00:00)
code2care  ttys000                         Sun Sep 10 10:46 - 10:46  (00:00)
code2care  console                         Sat Sep  9 20:03 - 01:22 (2+05:18)
_mbsetupuser console                       Sat Sep  9 20:00 - 20:03  (00:03)
root       console                         Sat Sep  9 20:00 - 20:00  (00:00)
reboot time                                Sat Sep  9 19:59

You can filter this information by piping this command with grep.

List of all recent Mac Shutdowns

Macbook % last | grep 'shutdown'

shutdown time                              Thu Sep 14 00:31
shutdown time                              Tue Sep 12 01:22

List of all recent Mac Reboots

Macbook % last | grep 'reboot'

reboot time                                Thu Sep 14 10:57
reboot time                                Tue Sep 12 09:58
reboot time                                Sat Sep  9 19:59

List of all recent Mac Logins

Macbook % last | grep 'logged'

code2care  ttys001                         Thu Sep 14 10:58   still logged in
code2care  ttys000                         Thu Sep 14 10:58   still logged in
code2care  console                         Thu Sep 14 10:58   still logged in