Jimmy Lai, the publisher of a popular tabloid, was convicted of national security charges on Monday after spending decades supporting the city’s vanquished pro-democracy movement.
Several of my utilities rely on being able to read log entries from your Mac. For most, this is the only way that you’re ever going to try to access the log. For a few this draws attention to potential problems, when the app discovers it can’t access the log and reports that as an error. This article explains what those errors mean, and what you can do to address them.
Log file layout
Files containing log entries are stored in two main locations in your Mac’s Data volume. The majority of them are in /var/db/diagnostics/, while additional and lengthier log data is stored in files named by UUID in /var/db/uuidtext/.
Those in /var/db/diagnostics/ are grouped into standard folders:
Persist holds tracev3 files that contain regular entries, the most important;
Special has similar files for shorter-life entries;
timesync contains files that enable the entries in tracev3 files to be matched with clock time;
Signpost holds tracev3 files for special entries for measuring performance;
HighVolume is normally empty, but might contain entries during periods when they’re particularly frequent.
Unlike traditional Unix log files, macOS doesn’t keep logs for a fixed period such as five days, but the logd process maintains them constantly to keep their total size within set limits that can’t be altered. Thus the period covered by log entries depends on how frequently entries are written to the log. In extreme cases, that can fall to just a few hours, or could extend to many days, although typically it should be at least 24 hours.
SilentKnight
My most popular app that’s also most frequently run, SilentKnight runs a single check that relies on being able to access the log, to look for XProtect Remediator scan reports.
Each time you run SilentKnight, as it prepares to display its window, it runs four checks on the log, those detailed below for LogUI and XProCheck. If any of those fail, rather than warning you in an alert, it simply disables its check for XProtect Remediator scans, and reports XPR scans not checked. If those pass correctly but it can’t find log entries for the scans, it reports no scans in the last 36 hours instead.
There are complications, though. SilentKnight will only check those scans once a day. If you run it more often than that, it won’t repeat those log checks on the XPR scans, and simply informs you XPR scans not checked. It’s only if you see that for the first check of the day that message suggests there may be a problem with the log. You can also disable checking for XProtect malware scans in the app’s settings.
If you see the message XPR scans not checked when you first run the app, and you haven’t disabled that check, then it’s worth running one of the other log utilities to discover why.
XProCheck, Mints, LogUI
Because these apps are all about inspecting log entries, they incorporate more extensive checks and report errors in more detail. To fetch entries from the log, Mints uses the log show command, while XProCheck and LogUI access them directly through macOS. They all run the following checks when the app is starting up, before its main window is displayed, and will warn you in an alert. When you dismiss that alert, the app will quit to allow you to fix the problem before running it again.
Tests used are:
Is the current user an admin user? If not, the alert below is displayed.
Are there any log files in the Persist folder? If not, report that it can’t find any log files.
Are there any timesync files? If not, report that it can’t find any log timesync files.
Can log show retrieve at least 1 log entry from the last 2 seconds? If it can’t, report that it can’t find any log entries on your Mac.
Mints runs another as well:
Can log show get times in the correct format? If it can’t, report the log time format is incorrect and advise the user to set time to 24-hour format.
Fixes
First, ensure that your Mac isn’t deleting log files in /var/db/diagnostics/ or /var/db/uuidtext/. Some ‘housekeeping’ utilities have taken to doing that, but it saves little space, usually well under 2 GB, and removes a mine of invaluable diagnostic information.
You can get fuller information about what’s in those folders with the Logs button in Mints, which also tells you the date of the oldest log entry. The same information is available in LogUI’s Diagnostics Tool.
The usual recommendation for Macs that aren’t writing any files into the Persist or timesync folders is to perform a clean reinstall of macOS or, for Apple silicon Macs, to restore the Mac in DFU mode. However, you’d be wise to contact Apple Support in the first instance, as this problem has occurred before.
If your log records only go back a few hours, there’s no simple way to reduce the rate at which new entries are written to the log. This article suggests some general approaches, and this article explains how to use custom logging profiles.
Jimmy Lai, the publisher of a popular tabloid, was convicted of national security charges on Monday after spending decades supporting the city’s vanquished pro-democracy movement.
Two people have been found dead at a home in Los Angeles identified by authorities as the residence of director and actor Rob Reiner, authorities say.
Firefighters were called to a house in Brentwood on Sunday afternoon, where they found the bodies of a 78-year-old man and 68-year-old woman who were pronounced dead at the scene, the LA Fire Department said.
Authorities did not immediately identify them or the circumstances surrounding their deaths.
Rob Reiner is 78 and his wife, Michele, is 68.
Reiner is a storied Hollywood filmmaker whose movies include classics such as The Princess Bride, When Harry Met Sally, and This is Spinal Tap.
This breaking news story is being updated and more details will be published shortly. Please refresh the page for the fullest version.
You can receive Breaking News on a smartphone or tablet via the BBC News App. You can also follow @BBCBreaking on X to get the latest alerts.
A person of interest has been detained in connection with a US shooting at Brown University that left two people dead, police said.
Nine others were injured when a gunman opened fire at the university in Providence on Saturday.
Police confirmed on Sunday a person had been detained, and an earlier order for people on the Brown campus and surrounding areas to shelter had been lifted.
Of those injured, medics said one person was in a critical condition, six were "critical but stable" and two others were less severely hurt.
The gunman opened fire in a classroom at around 16:00 local time (21:00 GMT) on Saturday at the Holley engineering building at the eastern end of Brown's campus, according to officials.
The identities of those killed or injured have not yet been released, but Brown University President Christina Paxson told reporters in a press briefing on Saturday that all the victims, including those killed and wounded, were students.
Police had earlier released CCTV footage of a male suspect walking away from the scene wearing all black clothing. Officers said a firearm was not found in a sweep of the building.
Mr. Reiner, who was in “All in the Family,” directed films including “This Is Spinal Tap,” “When Harry Met Sally …,” “The Princess Bride” and “A Few Good Men.”
Login
