With /usr/bin/log I can get information about the mail services from macOS's log system. E.g. /usr/bin/log show --start '2019-08-07 12:50:59' --end '2019-08-07 13:00:59' --predicate '(process == "smtp") || (process == "smtpd") || (process == "postscreen") || (process == "qmgr")' -info

I use run this via a script every night to get a semi-normal postfix log from macOS's log system.


#LOGDIR=/tmp # For testing

if mkdir "$LOCKDIR"
    # Lock acquired
    # Remove LOCKDIR when the script finishes, or when it receives a signal
    trap 'rm -rf "$LOCKDIR"' 0    # remove directory when script finishes

    ENDDATE=$(date -v-1S +"%Y-%m-%d %T")
    echo >&2 "Adding mail log data to $LOGFILE until cutoff $ENDDATE"
    if [ ! -f "$LOGDATEFILE" ]
        /usr/bin/log show --end "$ENDDATE" --predicate '(process == "smtp") || (process == "smtpd") || (process == "postscreen") || (process == "qmgr")' -info >> "$LOGFILE"
        echo >&2 "Adding mail log data to $LOGFILE from previous cutoff $STARTDATE"
        /usr/bin/log show --start "$STARTDATE" --end "$ENDDATE" --predicate '(process == "smtp") || (process == "smtpd") || (process == "postscreen") || (process == "qmgr")' -info >> "$LOGFILE"
    /bin/echo -n "$ENDDATE" >"$LOGDATEFILE"

    # Another one is already running or the lock was not cleaned up
    echo >&2 "Cannot acquire lock on $LOCKDIR. Giving up"
    exit 0

This used to work perfectly, and I had no need for my logs for a long while. Now I have, and I find out that the log extraction has become erratic. To be precise: while I can see a few messages being delivered (or greylisting-bounced) in the log, there are many that I know that have been delivered (they are in the user's mail box), but that do not show up in the log. I cannot think of a rational explanation.

Could it be that the database of macOS's log system is hosed and how do I find out?

  • The log files are located in: "/private/var/log". You can use the /Applications/Utilities/console to view what is in the log files. – historystamp Aug 8 '19 at 0:28
  • I didn't find /usr/bin/log on my yosemite system: is it a new command or did you download the log command from some where? – historystamp Aug 8 '19 at 0:30
  • I thought the new console only shows data after the app was started. – mmmmmm Aug 8 '19 at 11:14
  • log is part of High Sierra and Mojave at least. It interfaces with Unified Logging, the successor to ASL. – gctwnl Aug 17 '19 at 14:41

You must log in to answer this question.

Browse other questions tagged .