Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Right now my system.log gets recreated every 24 hours or so with a message like:

Jan  4 00:30:01 Mac newsyslog[63416]: logfile turned over

Can I change a setting such that it will get rotated every month? Or every week?

Having a much longer time would allow for better visibility of the progression of some errors.

share|improve this question

4 Answers 4

up vote 1 down vote accepted

The system calls newsyslog to prune files every time a 30th minute arrives (or a little bit later if the machine is either extremely busy or sleeping).

You can see the man page for newsyslog and it's configuration file or just dive in and edit the configuration file /etc/newsyslog.conf

For a pruning each month at midnight, you would change the time from @T00 to $M1D0 or for weekly on sunday at 3 AM to $W0D03

You might want to make sure you have enough space on your filesystem for a month - especially if you get some noisy software. You can also prune on size for a while if you wish, since that's easier to know when you'll want a prune based on how large a file you expect.

share|improve this answer

You use newsyslog command. There is plenty of online documentation out there on how to do this, but here's a start:

http://serverfault.com/questions/264292/osx-var-log-system-log-where-do-i-define-pruning-interval

share|improve this answer
    
Thanks for the link to another answer - I've filled in some of the details as many people here aren't as savvy with man pages as SF. –  bmike Jan 10 '13 at 3:12

Since your ultimate goal is to trace the history of information in the system.log files, you could, as an alternative, try grep from the command line, and search all system logs at once. I'm not a pro with grep, but looking for something like "shutdown" in all logs could be done via:

grep shutdown /var/log/system.log*

This would produce a single output with any line containing the word "shutdown". The * at the end is a regular expression that expands the search to all files starting with system.log, regardless of the extension that follows (e.g., system.log.0.bz2, system.log.0.bz3). If you grok regular expressions, aka "regex" (I do not), then you can further augment this kind of search and make it ridiculously powerful and specific. You can check out this link and this link for more information about regular expressions.

Also, if you wanted to view the results outside of Terminal, you could pipe the results to a plain text file via:

grep shutdown system.log* | ~/Desktop/results.txt

I realize this doesn't restructure your system logs, but it does get you the end result you're looking for.

share|improve this answer

If you are simply looking for ways to establish a timeframe for a crash, then either of the following may help:

% sysctl -a | grep boottime

% last | grep crash
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.