I have macOS unified logs from System A in .logarchive format. Any attempts to parse the .logarchive in System B using log show command provides following error:

bash-3.2#log show /tmp/unifiedlogsv2/unifiedlogs.logarchive
    log: Archive format needs updating (to version 3), doing so will render the archive unreadable by older tools.
    Re-run log with --force if you want to allow this upgrade

When run with --force option, the following error is displayed:

bash-3.2# log show --force /tmp/unifiedlogsv2/unifiedlogs.logarchive|more
log: warning: The log archive contains partial or missing metadata
log: Could not open log archive: The log archive format is corrupt and cannot be read

The same logarchive opens fine in Console. My objective is to parse the logarchive using the log show command. Any suggestions how to do so?

  • How did you make the specific log file? I'm guessing it's corrupt and not that you have a bad syntax. Can you verify that log stream is working to stream the unified feed that's not been processed or redirected to another file?
    – bmike
    Commented Apr 19, 2019 at 13:56
  • I used rsync to copy all the contents of /private/var/db/diagnostics/ and /private/var/db/uuidtext into a directory.Then used 'sudo mv -i -v /tmp/unifiedlogs/* /tmp/unifiedlogsv2/unifiedlogs.logarchive' .As already mentioned ,the same logarchive opens fine in Console Commented Apr 19, 2019 at 14:00
  • Thanks. I didn’t ask if console can open your collection, I was trying to discern if the log system was broken on the source mac. No worries if you don’t see value in clarifying / updating. Was just hoping to get you an answer or the beginning of one. You’ve got that now.
    – bmike
    Commented Apr 19, 2019 at 20:44

1 Answer 1


The man log page shows two switches, --file file and --archive archive. You will likely need to include one of them when working with archives from another system which didn't originate on the local system.

log show [--archive archive | --file file] [--predicate filter] [--source] [--style default | compact | json | syslog] [--color auto | always | none]
     [--start date/time] [--end date/time] [--[no-]info] [--[no-]debug] [--[no-]signpost] [--last time [m|h|d]] [--timezone local | timezone]

The man page goes on to detail those 2 switches like so:

    --archive archive
                     Display events stored in the given archive. The archive 
                     must be a valid log archive bundle with the suffix

    --file file      Display events stored in the given .tracev3 file. In order 
                     to be decoded, the file must be contained within
                     a valid .logarchive bundle, or part of the system logs 


Since you're working with .logarchive formatted files you likely want to use the --archive switch:

$ log show --archive /tmp/unifiedlogsv2/unifiedlogs.logarchive
  • The -file command requires .tracev3 format.While using --archive does the trick.Thanks Commented Apr 22, 2019 at 7:01
  • @swastibhushandeb - thanks I updated the A'er to include these details.
    – slm
    Commented Apr 22, 2019 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .