1

I would like to get older versions of /private/var/log/system.log files from TimeMachine. Is this possible? How?

I see current system.log files. I went to folder /private/var/log then invoked TimeMachine.

enter image description here

When I go back to previous backup, I do not see system.log files.

enter image description here

relates to can-i-find-out-the-last-time-a-specific-usb-was-connected-to-my-mbp7

User want to look through macOS log files to see history of external drive mounting. Data is in "/private/var/log/system.log". Needed data is a month old. A month is longer than normal backup of system.log is keep. Attempted to look in timemachine backup but it seems the older system.log files are not kept.

2
  • System log files are excluded from TM backups (see this question and the file /System/Library/CoreServices/backupd.bundle/Contents/Resources/StdExclusions.plist). AIUI this is because log files change all the time, and the method TM uses to make incremental backups would not work well with log files. Aug 18 '19 at 21:20
  • TimeMachine is intended as a safetynet for users, as such, it doesn’t track temporal system data. This is common accross many backup and versioning solutions Aug 19 '19 at 8:27
2

Everything in /private is excluded by rule - including /var/log/system.log

tmutil isexcluded /private/var/log/*

More details on this are at On OS X, what files are excluded by rule from a Time Machine backup?

You would need another tool to back these up as I’ve not had luck using the tmutil removeexclusion /var/log/system.log command which might have worked if the exclusion was based on a file pattern and not the rule.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .