You say these are OpenDirectory accounts. The server or servers to which these users can log in will track login and logout activity on themselves. I am assuming your user was also connecting to these servers using the AFP. Open the Console utility on a server and look at LOG FILES  /Library/Logs  AppleFileService.

• Log View For Mac Download

In the search field at the top right corner of the Console window, you can search for 'Log (with the quote mark) to see logins and logouts. Logins and logouts show the IP address of the user and a date/time stamp. You can also search for a username. AppleFileService logs the name as it was typed, which means if a user logged in using their shortname or their fullname, that's how it will appear in the log.

The result is that you may have to search for both 'jsmith' and 'John Smith'. You can also search for specific filenames in the AppleFileService logs. Bryan Vines.

Log View For Mac Download

Tech Tip: How To View The OS X Firewall Log Tuesday, January 12th, 2016 Author: Steve Sande. Before the holidays, I was running into an odd problem with my new iMac, and when I mean “odd”, I mean that it was acting as if someone was trying to access my Mac from somewhere else.