I have macOS unified logs from System A in .logarchive format. Any attempts to parse the .logarchive in System B using
log show command provides following error:
bash-3.2#log show /tmp/unifiedlogsv2/unifiedlogs.logarchive ========== /private/tmp/unifiedlogsv2/unifiedlogs.logarchive ========== log: Archive format needs updating (to version 3), doing so will render the archive unreadable by older tools. Re-run log with --force if you want to allow this upgrade
When run with
--force option, the following error is displayed:
bash-3.2# log show --force /tmp/unifiedlogsv2/unifiedlogs.logarchive|more log: warning: The log archive contains partial or missing metadata log: Could not open log archive: The log archive format is corrupt and cannot be read ========== /private/tmp/unifiedlogsv2/unifiedlogs.logarchive ==========
The same logarchive opens fine in Console. My objective is to parse the logarchive using the
log show command. Any suggestions how to do so?