Unified Logging
Definition
macOS 10.12+ replacement for syslog. Binary .tracev3 files in /var/db/diagnostics/ and /var/db/uuidtext/. Queried with `log show --predicate ...`. Holds an order of magnitude more than the legacy /var/log/system.log.
- Introduced
- macOS 10.12 (Sierra)
- File format
- Binary .tracev3
- Locations
- /var/db/diagnostics/ and /var/db/uuidtext/
- Query tool
- log show --predicate
Common questions
Why can't an examiner just read Unified Logging files as text like legacy syslog?+
The .tracev3 format is binary and stores log message templates and strings separately in the uuidtext directory, so a message has to be reconstructed by the log tool at query time rather than read directly off disk.
What does the much larger retention of Unified Logging mean for an investigation?+
It gives examiners a far deeper activity history than the old system.log allowed, but also means log volume can be large enough that a well-targeted predicate query is needed rather than dumping everything.
Related terms
- APFS
- Apple File System. Default on macOS since 10.13 High Sierra (2017). Container-and-volume design, copy-on-write, native snapshots, native encryption, space sharing across volumes...
- Keychain
- Apple's encrypted credential store. The per-user database at ~/Library/Keychains/login.keychain-db holds passwords, Wi-Fi PSKs, private keys, certificates and secure notes. Decryption needs the...
- Launchd
- macOS process supervisor that boots and manages every system and user service. Replaces init/cron/SysV-RC. Configured via .plist files under /Library/LaunchDaemons, /Library/LaunchAgents, and...
- Property List (Plist)
- Apple's key-value config file format. Either XML or binary (bplist00 magic). Parsed with plutil, plistutil, or mac_apt. Holds preferences, recent items, login...
- Time Machine
- Apple's built-in backup system. On HFS+ targets it produced incremental hard-link trees in Backups.backupdb; on APFS targets (macOS 11 Big Sur and...