log: Could not open local log store: The log archive format is corrupt and cannot be read

Question

I'm having some problems with my Macbook. The primary problem is that I'm unable to log into my admin account since a recent system update. I tried searching for solutions online, but haven't found any yet, I also haven't had time to go to an Apple store.

Now on my User account, a possibly related problem I have encountered is that I cannot access the logs, when I tried to run:

log show | grep 'Wake reason' | grep '2018-06'

I get:

log: Could not open local log store: The log archive format is corrupt and cannot be read

Does anybody have a clue what might be going on?

Answer 1

The error message you are seeing is very misleading. I believe what's actually happening is the system is preventing unprivileged accounts from reading the log contents. If you instead use sudo to execute the log show command as shown below, you'll get what you want.

Also, the log facility has a built-in method (via the --start and --end command-line switches) to limit the time range of log messages you want.

Give it a shot:

# log show --start "2018-08-01" --end "2018-08-31"

log: Could not open local log store: The log archive format is corrupt and cannot be read

# sudo log show --start "2018-08-01" --end "2018-08-31"

Skipping info and debug messages, pass --info and/or --debug to include.
Timestamp                       Thread     Type        Activity             PID    TTL  
2018-08-01 00:00:00.093146-0700 0x2f722d   Default     0x0                  879    7    com.apple.dock.extra: (CalendarFoundation) [com.apple.calendar:calendar] [com.apple.calendar.foundation.docktile] [[CalDockTileController] dateDidChange: NSCalendarDayChangedNotification]
.
.
.

Answer 2

The system logs are stored in ~/Library/Logs/DiagnosticReports/ or /var/logs. If you have problems loading the files in Console app, you can open them manually in TextEdit. Logs could be very helpful.

Restart the computer and after the chime press and hold the command + R keys until the recovery boots up.

When the menubar appears, select Terminal from the Utilities menu. Enter resetpassword at the prompt and follow instructions.

If this wouldn't solve your problem, try creating new admin user right from the recovery terminal. You should be able to login and access all the system and user-related files then.

After that I recommend you to backup everything you need and start over with a clean install.

You can tell us what version of macOS you are running now (providing logs if accessible), so I can edit my answer to be more relevant.