1

According to the Apple Tech Note https://developer.apple.com/library/content/technotes/tn2004/tn2123.html,

"CrashReporter limits the number of crash log files for any given combination of user, process name and host name. The current limit is 20."

Also, the ReportCrash manual states:

"ReportCrash is invoked automatically by launchd when a crash is detected. For applications and other processes running in the per-user launchd con- text, ReportCrash runs as a LaunchAgent and saves crash reports in the user's ~/Library/Logs/DiagnosticReports/ directory. For daemons, other processes running in the system launchd context and other privileged pro- cesses, ReportCrash runs as a LaunchDaemon and saves crash reports in the system's /Library/Logs/DiagnosticReports directory where they are only readable by admin users. If there are too many crash reports saved for a particular process, older reports will automatically be removed in order to conserve disk space."

I ran a test on a macOS 10.13.4 and managed to crash a process (running as root) for more than 20 times. After the 20th crash, some of the older crash logs were deleted. The odd part is that they seemed to be deleted based on an extra criteria, other than the time stamp. I expected that after 30 crashes, the first 10 (chronologically speaking) would be deleted. But they were deleted randomly (at least, at the first sight). I can't manage to identify the other factor in this automatic cleanup process. I hope I was explicit enough. Thanks!

  • 1
    Can you post a sample of the crash log in question? It's difficult to see from this far away.... – Allan Apr 16 '18 at 20:13
  • 1
    Sorry, Allan, I cannot post a sample. But I can tell you that the stack is almost the same in every crash. First, I thought it deletes the oldest crash logs with an identical stack, but it doesn't. It's weird. – metalkrad Apr 17 '18 at 9:08

You must log in to answer this question.

Browse other questions tagged .