3

I recently (within the last month) lost an external Hard drive - it had years of photos on it and I am devastated. To try and jog my memory, I am trying to find a way to find out the last time I connected it to my MacBook. Is this possible in any way using the system.log files?

Thanks in advance

Improve this question

2 Answers 2

Reset to default
3

If your MacOS version is 10.12 and later, you can use the advanced terminal log tool.

here is how to do the same with it (if you prefer)

log show --last 35m --info --predicate 'eventMessage contains "mounted"'

here it will search for messages containing the word "mounted", but only messages of type INFO (you could change it for ERROR or omit the --info flag to search all messages)

You can change the time, on the example I used --last 35m which means only on the last 35 minutes, but you can use it like --last 4h to search the last four hours for your criteria.

Example output, click to expand it: enter image description here

If you know the service subsystem, you can filter just by it, like the example below (I created the example for timeMachine subsystem, for syntax demonstration)

log show --predicate 'subsystem == "com.apple.TimeMachine" AND eventMessage contains "Failed"'

Use additional parameters like last hours, select kind of message, redirect the output to a file, etc...

The log console is very powerful and it can make queries like a database tool.

It is faster if you use the query syntax like above, but for some quick searchs you can also use 'grep', like the example below:

log show --style syslog --last 15m --info |grep '\[USB\]'

Show USB connection of my iPhone on my MacBook on the last 15 minutes: (using GREP to filter messages) and output style syslog

enter image description here

Statistics about the log database can be retrieved with sudo log stats (picture below) showing the date of the oldest message, date of most recent, and various other information and statistics.

Statistics (the command may take a long time to generate it, (> 5min ~ 10min) enter image description here

How much data/days to store? How to customise:

  1. for [MacOS 10.12 Sierra or newer] )

    • Storage parameters (such how much days to keep messages) can be changed/customised with sudo log config

see sudo log config --help or man log

  1. for [MacOS El Capitan, Yosemite or older] )
    • Log settings (such as how much log data to keep stored) can be customised by editing /etc/asl.conf. Default parameters of 50MB on average gives about 7 days of stored logs.

/etc/asl.conf enter image description here

Improve this answer
6
  • FYI: I am not able to find the log command in Yosemite. Was it added more recently? I'd like to use it myself.
    – historystamp
    Aug 8, 2019 at 19:27
  • Unified Logging is only available on macOS 10.12 and later. I didn't notice the version you are using. I will edit my answer inserting this information. Thank you for point it.
    – Prado
    Aug 8, 2019 at 19:53
  • Thank you so much, I hadn't considered using terminal but seems like it will make this much easier. Do you by any chance, know how far back you can search in terminal?
    – Chris Horsley
    Aug 8, 2019 at 22:46
  • On systems before 10.12, it is kept on several tar.gz files, compressed at each day, scheduled at mid night. On average it keeps the last 7 days, but it does not count it in days, but in filesize. Default is to keep maximum of 50MB of logs, compressed files, which gives about 7 days of messages. You can change/customize it on your system by editing /etc/asl.conf.
    – Prado
    Aug 9, 2019 at 10:57
  • For newer systems with Unified Logging, it is configurable, but the default configuration keeps 'error' and 'fault' messages for up to 30 days, 'info' messages for up to 14days. 'default' (non-important messages) are kept for up to 7, 3 or 1 day, depending ob the 'TTL' value of each kind of message. It is also configurable, if you wish you can change log storage settings with 'sudo log config' and get statistics about the log database executing 'sudo log stats'
    – Prado
    Aug 9, 2019 at 11:01
0

You can look with /Applications/Utilities/Console. First you should figure out what messages will appear then you attach the drive. Once you know the message you can search for it.

You can find prior logs by scrolling down. I don't see the logs going back all that far. You need to search each file. You will find more info, if you know the name of the drive. This answer is based on Yosemite, 10.10.5.

enter image description here

Start console and place it so you can see it. Dismount drive if already mounted. You can either pull and re-attach connector or power-off and power-on. See what messages appear. You will see different messages for different device types.

For an external 4TB harddrive directly connect to my mac mini, here is what I saw.

enter image description here

For a flash drive attached to a usb hub, I found the message "getting new uuid:" in system.log[s].

enter image description here

There were mysterious error messages reported when I searched on a drive name. enter image description here

another way is to use grep in the terminal. The logs are in the folder "/private/var/log/system.log"

mac $ grep -ni -e "dosfat32" /private/var/log/system.log
1395:Aug  6 16:50:13 macLocal.local fseventsd[60]: could not open <</Volumes/DOSFAT32/.fseventsd/fseventsd-uuid>> (No such file or directory)
1396:Aug  6 16:50:13 macLocal.local fseventsd[60]: Failed to load UUID.  Removing all old log files in /Volumes/DOSFAT32/.fseventsd
1397:Aug  6 16:50:13 macLocal.local fseventsd[60]: log dir: /Volumes/DOSFAT32/.fseventsd getting new uuid: 6C3ACC63-0DD6-4ED6-9223-486DB3D22E8B
1408:Aug  6 16:53:57 macLocal.local fseventsd[60]: log dir: /Volumes/DOSFAT32/.fseventsd getting new uuid: 6D650AA2-14C2-4864-9BEB-9D5DD34A583F
Improve this answer
5
  • Thanks so much for trying to help me! I have tried connecting a different external hard drive and entering "getting new uuid:" in the bar at the top of console. Its not showing any results - is there some settings or anything that I need to change?
    – Chris Horsley
    Aug 8, 2019 at 14:40
  • I added some more info.
    – historystamp
    Aug 8, 2019 at 19:26
  • Hi, your commands and instructions are correct, but I think the log he wants is no more stored, because he said it was "within the last month". By average those compressed .gz files keeps a maximum of 7 to 10 days, depending on the message flux, up to the maximum limit of 50Mb (if using default settings)
    – Prado
    Aug 9, 2019 at 11:42
  • If I were to restore from an old Time machine backup, would I be able to use terminal from that point?
    – Chris Horsley
    Aug 18, 2019 at 11:32
  • This is a interesting idea. See my question on how to access system.log in TimeMachine: apple.stackexchange.com/questions/367023/…
    – historystamp
    Aug 18, 2019 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .