Does anyone know if there’s a way to do a query th...
# macos
Does anyone know if there’s a way to do a query that’ll tell you if a macbook lid is closed? or if the screensaver is running/sleeping?
I know I’ve found a way to get the length of time a machine has been awake for. (Though I forget where I found that)
Though that’s not really the same as lid closed
Yea that’s the
I’m looking around seeing if there’s a file that gets created when the lid is closed or something
Uptime is time since boot. There’s another plae to query time since sleep.
But that’s not the same as whether or not it’s locked
oh interesting! yea I misread
I’ll keep looking and update here if you’re curious
Ah ok, found this nice command:
pmset -g log|grep -e " Sleep  " -e " Wake  "
Now how to expose that through osquery
I know I found something in it already. Maybe in nvram or a plist somewhere
interesting, maybe screen/battery saver has a plist file
the screensaver time is in the power management plist
i'll nab you a query i wrote for that
Copy code
osquery> SELECT * FROM plist WHERE path = '/Library/Preferences/';
| key                 | subkey                          | value | path                                                 |
| SystemPowerSettings | Update DarkWakeBG Setting       | 1     | /Library/Preferences/ |
| AC Power            | Display Sleep Uses Dim          | 1     | /Library/Preferences/ |
| AC Power            | DarkWakeBackgroundTasks         | 1     | /Library/Preferences/ |
| AC Power            | Wake On LAN                     | 1     | /Library/Preferences/ |
| AC Power            | System Sleep Timer              | 10    | /Library/Preferences/ |
| AC Power            | Disk Sleep Timer                | 10    | /Library/Preferences/ |
| AC Power            | Automatic Restart On Power Loss | 0     | /Library/Preferences/ |
| AC Power            | GPUSwitch                       | 2     | /Library/Preferences/ |
| AC Power            | Display Sleep Timer             | 10    | /Library/Preferences/ |
Bear in mind any plist can be overwritten by managed_policies etc. and is not the safest point of reference
This also does not answer your original question
which is whether the lid is closed or the screensaver is currently active
Interesting, so these are just settings right?
Still useful! thank you!
That's correct @grant seltzer
Unfortunately these prefs do not seem to be captured in the standard
table so plists are your best option
If you ever want to search for plists that encode settings/preferences my workflow is typically to use and then while it is running adjust a given setting:
Hm, what exactly am I looking at here?
Why would a plist file not encode settings?
You are looking at the output of FSMonitor an app that monitors all File System events while recording.
I changed my Energy Saver settings while recording in FSMonitor to see the files that were touched.
Which led me to
There is a way to retrieve lid state from the terminal using
you can run the following:
Copy code
ioreg -r -k AppleClamshellState -d 4 | grep AppleClamshellState  | head -1
🆒 1
ah cool, that one was really helpful, thank you!
I can’t use osquery to shell out and run that command, can I?
Not in core, no.
You can write a plugin.
I suppose that’s a good thing lol
Thank you!
It might be a good idea to explore creating a table that gives you all of the ioreg properties for a given node name
@theopolis That is an awesome idea!
Vs. a dozen tables with the same underlying approach
osquery 1
Pardon the thread necromancy, but I bikeshedded on this in the meantime
Copy code
/usr/sbin/ioreg -r -k AppleClamshellState -d 4 | /usr/bin/awk '/ClamshellS/ {print $4}'
Kolide launcher ships an ioreg table (it’s an exec) if make not be suitable for all environments.