7

In console app I can see only couple system.log.${i}.gz archived log files that can only show me info about last 10-15 days. How to keep all logs archived somewhere, forever ?

  • Use a dedicated syslog server and send the logs there. Alternatively, change the log rotation to never delete anything. – John Keates Dec 18 '16 at 13:22
  • You could give me a terminal command / article that explains just that: Alternatively, change the log rotation to never delete anything. ? – myhau Dec 18 '16 at 13:26
  • 2
    Here's how you can configure syslog to send data to a dedicated syslog server: wiki.splunk.com/… And if you want to play with log rotation, apparently (according to a quick DuckDuckGo search), you wanna look at /etc/asl.conf and man asl.conf. I'm not familiar with asl, so I don't know how it works, but looking at the file and man page I imagine it can be figured out pretty quick. – Harv Dec 20 '16 at 21:03
6

The log files are rotated and eventually removed by the asl system. You can change the configuration by editing /etc/asl.conf under sudo. Start Terminal.app and issue this command:

sudo -e /etc/asl.conf

You'll find in there a comment stating that rules for /var/log/system.log follows, the first line looks like this:

> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=50M

Change that to look like this:

> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=9999G ttl=99999

This means that each seperate log file will be maximum 5M. Normally the asl system removes log files when either they exceed the all_max limit (before 50 megabyte, now 9999 gigabytes) or when the file is older than ttl days (before 7 days, now 99999 days).

  • 1
    Do not use sudo to run an editor just to edit a file that requires elevated privileges to write. For security and safety reasons you should restrict the amount of code that you run as root. Instead, use sudo -e …, which will copy the file to /tmp and start your editor. When you exit the editor sudo then copies the file back. See the man page <x-man-page://8/sudo> for details. – Chris Page Dec 13 '18 at 22:12
  • It's worth pointing out that letting the system.log grow to very large size will have a performance impact on your Mac. Large files take longer to write to than small ones. – benwiggy May 20 at 13:17
  • @benwiggy Not really, no? - Appending to a very large file is no slower than appending to a smaller file. In any case, it is not relevant here as the files are no larger than before after making this change. – jksoegaard May 20 at 13:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .