How To

In a recent article, we looked at how you get software updates on your Mac. You get updates in three ways. If you bought apps from the Mac App Store, that app provides updates. If you bought apps directly from developers, they apps generally use their own update system; occasionally you may need to download an update from a developer’s website. And for macOS updates and security updates, it’s the Software Update preference pane that manages these updates.

Some people prefer to update their apps and Macs manually: they check the Mac App Store or the Software Update preference pane to see when updates are available, or they react when their Macs present notifications. Others prefer to let all this occur automatically. In the latter case, you may not even notice many of the updates: they can happen in the background, though you do need to restart your Mac for major operating system and security updates. And your Mac can automatically, and silently, install “system data files and security updates” in the background without telling you.

There’s no easy way to find what has been updated, especially if updates have been made automatically in the background. You can check the Mac App Store’s Updates section to see which apps have been updated, but it only shows the most recent updates; and there’s no log for system updates. In this article, I’ll tell you how you can see a list of everything that’s been updated, automatically or manually, on your Mac via the Mac App Store and Software Update.

Finding the update log

As I said above, there is no visible software update log. The Mac App Store lists the last dozen updates, and the Software Update preference pane doesn’t list any at all. The latter handles updates to macOS, but also some additional items like system data files and security updates. It can be useful to know what was updated when, especially if you find that you have issues on your Mac.

To see a list of items updated, go to the /Library/Receipts folder. You’ll find a file there named InstallHistory.plist.

Understanding the update log

A .plist file is a preferences or settings file, but this type of file can also be used for logs. It’s an XML file, which you can view in a text editor or in Xcode (Apple’s developer tool, which you can download from the Mac App Store. If you do have Xcode, it’s a lot easier to view this log; but it’s an 8 GB download, and if you don’t need it for anything else, there’s no point in getting it.

If you view the file in a text editor, its content starts like this:

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

After the above section, each update is presented in this form:

<dict>
	<key>date</key>
	<date>2020-05-27T09:15:14Z</date>
	<key>displayName</key>
	<string>macOS Catalina 10.15.5 Update</string>
	<key>displayVersion</key>
	<string> </string>
	<key>packageIdentifiers</key>
	<array>
		<string>com.apple.pkg.macOSBrain</string>
	</array>
	<key>processName</key>
	<string>softwareupdated</string>
</dict>

The entry closest to the bottom of the file is what was installed most recently. In the example above, this was an operating system update for macOS Catalina. As you’ll notice, there are a number of different updates in the “array” section, as different elements of macOS were updated.

The following day, I updated an app from the Mac App Store, and this is what displays in the file:

<dict>
	<key>date</key>
	<date>2020-05-28T13:35:07Z</date>
	<key>displayName</key>
	<string>RAW Power</string>
	<key>displayVersion</key>
	<string>3.0.4</string>
	<key>packageIdentifiers</key>
	<array>
		<string>com.gentlemencoders.RAWPower</string>
	</array>
	<key>processName</key>
	<string>appstoreagent</string>
</dict>

Note one difference between the two: for the macOS 10.15.5 update, you can see the last “string” section specifies that it was installed by softwareupdated, a background process that is used to install system files and security updates. The latter file, installed from the Mac App Store app, was installed by a process called appstoreagent.)

And when you install an app from an installer that you download directly, using the Mac’s Installer app, the file tells you this with the following:

<string>Installer</string>

Here’s another interesting entry on my system:

<dict>
	<key>contentType</key>
	<string>config-data</string>
	<key>date</key>
	<date>2020-05-29T23:46:05Z</date>
	<key>displayName</key>
	<string>XProtectPlistConfigData</string>
	<key>displayVersion</key>
	<string>2122</string>
	<key>packageIdentifiers</key>
	<array>
	 <string>com.apple.pkg.XProtectPlistConfigData_10_15.16U4111</string>
	</array>
	<key>processName</key>
	<string>softwareupdated</string>
</dict>

This XProtectPlistConfigData is information that is installed on Macs to use what is often called XProtect, a rudimentary bad-download blocker that checks apps against an Apple database the first time you launch an app after downloading it.

Depending on how long you’ve had your Mac, and how you’ve upgraded from previous Macs, your InstallHistory.plist file may be very long. If you copy a clone of one Mac to a new one, or migrate from one Mac to another, it will continue using the same file. In my case, the file goes back to 2014, the last time I did a clean installation. (If you’re curious about whether it’s better to migrate or do a clean installation, see this article.)

While there’s no reason to check this file regularly, it’s good to know how to find what software has been installed, especially if your Mac has issues. If you can isolate your problem to a specific date, check this file to see if any software updates might be causing your problems.

How can I learn more?

Every week, Intego’s experts discuss Apple security on the Intego Mac Podcast, so be sure to subscribe to make sure you don’t miss the latest episode. You’ll also want to subscribe to our e-mail newsletter and keep an eye here on The Mac Security Blog for updates.

You can also follow Intego on your favorite social and media channels: Facebook, Instagram, Twitter, and YouTube (click the ? to get notified about new videos).

About Kirk McElhearn