macOS · open source · MIT · v0.3.0
A terminal flashed. An app opened by itself. macOS said “Background Items Added”. The Mac restarted overnight. The answers are already on your Mac, buried in 14,000 log lines a minute. lately knows which few hundred matter and turns them into a short timeline. One command. No root, no daemon, no AI.
brew install matthew-eucaristo/tap/lately
Then run lately. It only reads. Other ways to install →
The real output of lately --replay demo/sample, generated when this page was built, with times moved to your clock. Generic sample data, not your Mac, and nothing here reads your Mac.
Classified, not dumped
Eight narrow log lenses, crash reports, boot and power records, install receipts and the folders software uses to start itself. 42 rules put every event at one of five levels, group bursts into one row (×3), hide Apple's own noise and stop marking things NEW once you have seen them.
Glyphs and words always sit next to colour, and NO_COLOR is honoured.
The questions it answers
With sudo lately capture, a shell that an osascript, launchd job or cron job started, and that lived under 2 seconds, becomes an EXEC row. A shows the chain that started it. A parent that exited before capture is shown as chain broken, never guessed.
launchd (1) Apple └─ com.foovpn.helper (4300) Dev ID ABCDE12345 └─ osascript (4321) Apple └─ zsh (4322) zsh -c curl -fsSL https://… | sh ◀
Every new launch agent, daemon, login item, system extension, cron entry, SSH key or shell-startup change becomes a row, with its signer and the install that wrote it. Persistence rules carry MITRE ATT&CK IDs.
▲ HIGH PERSIST Launch daemon added: com.foovpn.helper
WHY Written during the Foo VPN install (Installer)
DO Expected? press a. Not expected? launchctl bootout …
Apple silicon logs no shutdown cause code. lately combines wtmp, the panic breadcrumb, DumpPanic's check, shutdown-stall reports, the watchdog record, recent updates and the last power line into one verdict.
VERDICT ● Hung shutdown ✓ watchdog a watchdog reset (wdog) ✓ stall 1 shutdown_stall report
Press f and reproduce it. One log stream per lens, plus crash reports, installs and launch items rechecked every 5 s. New rows land on top in green; a repeat bumps its ×N in place.
since 17:01 ● live 8s ▲ new HIGH at 17:16:35: shop-app crashed ×4
Screen Recording, camera and microphone answers, Gatekeeper checks and XProtect detections. Rows read from log text Apple does not document are marked ≈approx.
▲ HIGH PERMIT com.meetapp.desktop allowed Screen Recording NEW ≈approx
t reaches one step further back (5m … 7d) and reads only the span it adds; T comes back without rereading. The header says how far back the log really reaches.
window 5m 15m 30m 1h 2h 3h 6h 12h 1d 2d 3d 7d
An event card for every row
Press ⏎ on any row. Every card has the same sections, then the subject's own activity over the window and its related findings: the same process, its parent or children, the launch item that runs it, the install that delivered it, the same developer. Cards suggest commands; they never run them.
▲ HIGH · PERSIST · Launch daemon added: com.foovpn.helper WHAT A program will now start as root at every boot: /Library/PrivilegedHelperTools/com.foovpn.helper WHO com.foovpn.helper · Developer ID ABCDE12345 Developer ID Application: Foo VPN Inc (ABCDE12345) first seen on this Mac WHY Written during the Foo VPN install (Installer, 17:02:52) MATTERS Launch daemons run as root without anyone logged in. They are how installers add services, and how malware stays on a Mac. MITRE ATT&CK T1543.004 DO Expected? press a to mark it known. Not expected? sudo launchctl bootout system/com.foovpn.helper RAW /Library/LaunchDaemons/com.foovpn.helper.plist SOURCE persist · rule persist.launch_daemon v1 · confidence ✓ ── ACTIVITY ────────────────────────────────────────────── 17:01 ·····█································ 17:16 ── RELATED · 1 install · 2 same developer ──────────────── ▌ -3s install · INFO Installed Foo VPN 3.2 +3s same developer ✖ CRIT System extension added
/usr/bin/log show command to check it yourself.lately why-restart
Apple silicon Macs log no shutdown cause code, so lately weighs everything that is left and says exactly one of:
When the verdict is inferred, it says so. Press R in the demo above to see this one live.
Why did my Mac restart? booted 03:12 today (Apple silicon) VERDICT ● Hung shutdown A shutdown or restart got stuck and macOS wrote a shutdown-stall report. It never finished: the hardware watchdog reset the Mac. ──────────────────────────────────────────────────── ✓ wtmp no shutdown record → not clean · panic DumpPanic found no panic log ✓ watchdog reset (wdog) → stopped responding ✓ stall 1 shutdown_stall report · update no macOS update around it ✓ power the Mac was awake → AC, 64% ✓ last words 03:12:19 (WindowServer) ──────────────────────────────────────────────────── No shutdown cause code: inferred.
Honest about blind spots
Every limit is named on screen, every run. ? lists all of them.
macOS keeps a few days at most, and log stats overstates it. lately reads the oldest file in the log store and prints how far back it really reaches.
Many log fields read <private>. lately counts them instead of pretending they are not there.
Without sudo lately capture you see that Terminal launched, not the 200 ms shell inside it.
No shutdown cause code on Apple silicon, so the verdict says “inferred”.
Permission and Gatekeeper rows come from log text Apple does not document, and they carry ≈.
Recording which app talked to which host needs a firewall extension such as LuLu. lately net shows live connections only.
ⓘ The unified log reaches back to Oct 25 13:02 (2.1 days); older log events are gone. ⓘ 12 field(s) were redacted by macOS as <private>. ⓘ Commands and parents of short-lived processes need capture: sudo lately capture ⓘ Restart causes are inferred: Apple silicon Macs log no shutdown cause code.
What it reads
Everything below is readable by a normal user. lately runs /usr/bin/log, pmset, last, codesign, systemextensionsctl, lsof, nettop and ps, or reads files directly. No frameworks, no cgo.
RunningBoard launches, TCC decisions, Gatekeeper, XProtect Remediator, Background Task Management, DumpPanic, jetsam and shutdown cause, log erase.
Crashes, faults, hangs, jetsam, resource reports, shutdown stalls and panics, from one JSON line per .ips.
kern.boottime, last reboot, last shutdown and the DumpPanic breadcrumb.
Sleep, wake, dark wake and failures, and whether the Mac was on AC before a restart.
InstallHistory, install.log and Homebrew logs, so a new background item points to the install that wrote it.
Launch agents and daemons with their signatures, crontab, shell startup files, authorized_keys and system extensions.
lsof and nettop: what your processes are connected to right now.
sudo lately captureApple's eslogger as a child process for exec, fork, exit, background items, TCC, XProtect and more. In memory only, and it stops when you quit.
Privacy & footprint
log stream children included.lately forget deletes it.log stream children at 0.1–0.4% together. Child tools run at nice 10./Users/ana/… on anas-mbp · C02XK1ZZJGH5 · 10.0.4.21~/… on HOST-1 · SERIAL · IP-1Home folder, user and host names, serial number, UUIDs, IP and e-mail addresses and URL paths become stable placeholders, so an export can go straight into an issue or a chat.
Use
Plain text when piped, redacted JSON with a stable contract, and exit codes that say what was found.
| 0 | nothing at or above the floor |
| 1 | Medium or High rows |
| 2 | a Critical row |
| 3 | the requested tier needs privileges |
| 4 | usage error, or every source failed |
# TUI: last 15 minutes, Medium and above
lately
# any window: 5m, 1h, 24h, 2d, boot…
lately --since 1h
# plain text, redacted JSON, redacted Markdown
lately --list
lately --json
lately --md > incident.md
# redacted brief for an AI agent (TUI: y)
lately --brief | pbcopy
# the restart verdict; live network
lately why-restart
lately net
# every rule, level band, tier and MITRE ID
lately rules
# elevated: process ancestry while it runs
sudo lately capture
# speak up when something serious happened
lately --since 1h --min-level high --list >/dev/null \
|| say "check your Mac"Install
brew install matthew-eucaristo/tap/latelyThe recommended way on macOS.
go install github.com/Matthew-Eucaristo/lately@latestNeeds Go 1.26 or later.
Download from GitHub Releases →
Prebuilt archives for Apple silicon and Intel Macs.
eslogger (macOS 13 or later).lately --replay demo/sample reads nothing from your Mac.lately forget # removes the baseline file and its folder
brew uninstall lately
brew untap matthew-eucaristo/tap # if nothing else uses the tapQuestions
No. lately is a diagnostics tool: it explains what happened, with evidence, and suggests what to do. It removes nothing and changes nothing. It does surface XProtect detections and the persistence tricks malware relies on, which makes it a good first look before you reach for anything heavier.
Console shows everything, about 14,000 lines a minute, mostly Apple talking to itself. lately reads eight narrow slices of the log plus evidence Console does not show at all (crash report headers, boot records, install receipts, launch items), classifies it with 42 rules and groups the rest away.
No. Everything in the timeline is readable by a normal user. Only sudo lately capture is elevated, for short-lived processes and their command lines, and it runs only while you keep it open. lately never asks for your password itself.
No network connections, no telemetry, no AI. The classification is 42 readable YAML rules you can tune without touching Go. If you want an agent's read anyway, y (or --brief) copies a redacted brief that you paste yourself. This page loads nothing from third parties either.
NEW means this Mac has not seen the subject before. To know that, lately keeps one file of salted hashes and dates, never names or paths. The first run marks nothing NEW and says so. --no-baseline runs without it; lately forget deletes it.
Yes, that is what --md, --json and the e export are for. They are redacted by default; --no-redact shows real names when you need them.
macOS only for now. The sources sit behind a cross-platform interface, so a port is a new package beside the macOS one; rules and views stay.
brew install matthew-eucaristo/tap/latelyThen just type lately.