0

I have macOS unified logs from System A in .logarchive format. Any attempts to parse the .logarchive in System B using log show command provides following error:

bash-3.2#log show /tmp/unifiedlogsv2/unifiedlogs.logarchive
        ==========
    /private/tmp/unifiedlogsv2/unifiedlogs.logarchive
        ==========
    log: Archive format needs updating (to version 3), doing so will render the archive unreadable by older tools.
    Re-run log with --force if you want to allow this upgrade

When run with --force option, the following error is displayed:

bash-3.2# log show --force /tmp/unifiedlogsv2/unifiedlogs.logarchive|more
log: warning: The log archive contains partial or missing metadata
log: Could not open log archive: The log archive format is corrupt and cannot be read
==========
/private/tmp/unifiedlogsv2/unifiedlogs.logarchive
==========

The same logarchive opens fine in Console. My objective is to parse the logarchive using the log show command. Any suggestions how to do so?

  • How did you make the specific log file? I'm guessing it's corrupt and not that you have a bad syntax. Can you verify that log stream is working to stream the unified feed that's not been processed or redirected to another file? – bmike Apr 19 at 13:56
  • I used rsync to copy all the contents of /private/var/db/diagnostics/ and /private/var/db/uuidtext into a directory.Then used 'sudo mv -i -v /tmp/unifiedlogs/* /tmp/unifiedlogsv2/unifiedlogs.logarchive' .As already mentioned ,the same logarchive opens fine in Console – swasti bhushan deb Apr 19 at 14:00
  • Thanks. I didn’t ask if console can open your collection, I was trying to discern if the log system was broken on the source mac. No worries if you don’t see value in clarifying / updating. Was just hoping to get you an answer or the beginning of one. You’ve got that now. – bmike Apr 19 at 20:44
1

The man log page shows two switches, --file <file> & --arcive archive that you'll likely need to include one of them when working with archives from another system which aren't the local system's.

log show [--archive archive | --file file] [--predicate filter] [--source] [--style default | compact | json | syslog] [--color auto | always | none]
     [--start date/time] [--end date/time] [--[no-]info] [--[no-]debug] [--[no-]signpost] [--last time [m|h|d]] [--timezone local | timezone]

The man page goes on to detail those 2 switches like so:

    --archive archive
                     Display events stored in the given archive. The archive 
                     must be a valid log archive bundle with the suffix
                     .logarchive.

    --file file      Display events stored in the given .tracev3 file. In order 
                     to be decoded, the file must be contained within
                     a valid .logarchive bundle, or part of the system logs 
                     directory.

Example

Since you're working with .logarchive formatted files you likely want to use the --archive switch:

$ log show --archive /tmp/unifiedlogsv2/unifiedlogs.logarchive
  • The -file command requires .tracev3 format.While using --archive does the trick.Thanks – swasti bhushan deb Apr 22 at 7:01
  • @swastibhushandeb - thanks I updated the A'er to include these details. – slm Apr 22 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .