Home > Logging, Mac administration, macOS > Determining log retention periods for macOS unif 2026-10-14 21:25:45 Author: derflounder.wordpress.com(查看原文) 阅读量:18 收藏
Home > Logging, Mac administration, macOS > Determining log retention periods for macOS unified logging
Determining log retention periods for macOS unified logging
Every so often when working with the unified logging system, you need to know how far back the current logging goes. After all, if you’re looking for logs for something that happened last week, it’s a good idea to check if your Mac’s logs actually go back that far.
You can accomplish this using the log command line tool, using the following command:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /usr/bin/log stats –overview |
Note: This command may take a few minutes to run while it builds the requested logging overview, so patience is recommended.
The overview includes a large amount of data about the logging currently stored on your Mac and among the items displayed will be the times and dates of both the oldest log entry and the newest log entry using the start and end values. The start value is the oldest and the end value is the newest.
If you have a unified system log archive file, you can check for the archive’s oldest and newest log entries the same way:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /usr/bin/log stats –overview –archive /path/to/archive_file_goes_here |
By default, this information is displayed in a human-readable format but it can also be exported in JSON format.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /usr/bin/log stats –overview –style json |
This is convenient because now we can use command line tools like jq to parse the JSON output and return just the start and end values we want. For example, the following command should get the start and end values and convert them to being displayed in UTC time:
Note: By default, the log command will use your computer’s local time zone for displaying the times. I’m using UTC here as a personal preference.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /usr/bin/log stats –overview –style json | /usr/bin/jq -r '.start, .end | sub("\\.[0-9]+"; "")' | { read -r s; read -r e; echo "Oldest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$s" "+%Y-%m-%d %H:%M:%S UTC")"; echo "Newest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$e" "+%Y-%m-%d %H:%M:%S UTC")"; } |
The output from this command should look similar to what’s shown below:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| username@ZCDP1X75FT ~ % /usr/bin/log stats –overview –style json | /usr/bin/jq -r '.start, .end | sub("\\.[0-9]+"; "")' | { read -r s; read -r e; echo "Oldest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$s" "+%Y-%m-%d %H:%M:%S UTC")"; echo "Newest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$e" "+%Y-%m-%d %H:%M:%S UTC")"; } | |
| Oldest log entry: 2026-09-28 17:45:16 UTC | |
| Newest log entry: 2026-10-14 21:08:58 UTC | |
| username@ZCDP1X75FT ~ % |
You can do the same with a unified system log archive file using a command like the one shown below:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /usr/bin/log stats –overview –style json –archive /path/to/archive_file_goes_here | /usr/bin/jq -r '.start, .end | sub("\\.[0-9]+"; "")' | { read -r s; read -r e; echo "Oldest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$s" "+%Y-%m-%d %H:%M:%S UTC")"; echo "Newest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$e" "+%Y-%m-%d %H:%M:%S UTC")"; } |
If the log archive file is stored on your Desktop, you can run a command like this one:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /usr/bin/log stats –overview –style json –archive $HOME/Desktop/system_logs.logarchive | /usr/bin/jq -r '.start, .end | sub("\\.[0-9]+"; "")' | { read -r s; read -r e; echo "Oldest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$s" "+%Y-%m-%d %H:%M:%S UTC")"; echo "Newest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$e" "+%Y-%m-%d %H:%M:%S UTC")"; } |
The output from the command above should look similar to what’s shown below:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| username@ZCDP1X75FT ~ % /usr/bin/log stats –overview –style json –archive $HOME/Desktop/system_logs.logarchive | /usr/bin/jq -r '.start, .end | sub("\\.[0-9]+"; "")' | { read -r s; read -r e; echo "Oldest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$s" "+%Y-%m-%d %H:%M:%S UTC")"; echo "Newest log entry: $(/bin/date -u -jf "%Y-%m-%d %H:%M:%S%z" "$e" "+%Y-%m-%d %H:%M:%S UTC")"; } | |
| Oldest log entry: 2026-10-13 20:47:14 UTC | |
| Newest log entry: 2026-10-14 19:08:49 UTC | |
| username@ZCDP1X75FT ~ % |
如有侵权请联系:admin#unsafe.sh