Does anyone know if there s a way to do a query that ll tell

Question

Does anyone know if there s a way to do a query that ll tell you if a macbook lid is closed or if the screensaver is running sleeping

seph · Answer

I know I ve found a way to get the length of time a machine has been awake for Though I forget where I found that

seph · Answer

Though that s not really the same as lid closed

grant seltzer · Answer

Yea that s the `uptime` table

grant seltzer · Answer

I m looking around seeing if there s a file that gets created when the lid is closed or something

seph · Answer

Uptime is time since boot There s another plae to query time since sleep

seph · Answer

But that s not the same as whether or not it s locked

grant seltzer · Answer

oh interesting yea I misread

grant seltzer · Answer

I ll keep looking and update here if you re curious

grant seltzer · Answer

Ah ok found this nice command

grant seltzer · Answer

`pmset g log|grep e Sleep e Wake `

grant seltzer · Answer

Now how to expose that through osquery

seph · Answer

I know I found something in it already Maybe in nvram or a plist somewhere

grant seltzer · Answer

interesting maybe screen battery saver has a plist file

fritz · Answer

the screensaver time is in the power management plist

fritz · Answer

i ll nab you a query i wrote for that

fritz · Answer

fritz · Answer

Bear in mind any plist can be overwritten by managed policies etc and is not the safest point of reference

fritz · Answer

This also does not answer your original question

fritz · Answer

which is whether the lid is closed or the screensaver is currently active

grant seltzer · Answer

Interesting so these are just settings right

grant seltzer · Answer

Still useful thank you

fritz · Answer

That s correct < grant seltzer>

fritz · Answer

Unfortunately these prefs do not seem to be captured in the standard `preferences` table so plists are your best option

fritz · Answer

If you ever want to search for plists that encode settings preferences my workflow is typically to use FSMonitor app and then while it is running adjust a given setting

grant seltzer · Answer

Hm what exactly am I looking at here

grant seltzer · Answer

Why would a plist file not encode settings

fritz · Answer

You are looking at the output of FSMonitor an app that monitors all File System events while recording

fritz · Answer

I changed my Energy Saver settings while recording in FSMonitor to see the files that were touched

fritz · Answer

Which led me to `com applePowerManagement plist`

fritz · Answer

There is a way to retrieve lid state from the terminal using `ioreg` you can run the following ```ioreg r k AppleClamshellState d 4 | grep AppleClamshellState | head 1```

grant seltzer · Answer

ah cool that one was really helpful thank you

grant seltzer · Answer

I can t use osquery to shell out and run that command can I

seph · Answer

Not in core no

seph · Answer

You can write a plugin

grant seltzer · Answer

I suppose that s a good thing lol

grant seltzer · Answer

Thank you

theopolis · Answer

It might be a good idea to explore creating a table that gives you all of the ioreg properties for a given node name

fritz · Answer

< theopolis> That is an awesome idea

fritz · Answer

Vs a dozen tables with the same underlying approach

allister · Answer

Pardon the thread necromancy but I bikeshedded on this in the meantime ``` usr sbin ioreg r k AppleClamshellState d 4 | usr bin awk ClamshellS print $4 ```

seph · Answer

Kolide launcher ships an ioreg table it s an exec if make not be suitable for all environments