Eventlog macOS

log show --predicate 'eventMessage contains "exec"' --last 1h | grep -E 'softwareupdate|cloud|trust|analytic|push|apple'
``