Whenever I run the
log show command from the command line, I get a warning message,
log: warning: The log archive contains partial or missing metadata.
This appears to prevent me from using the
--last option to limit output to the most recent time interval. The failed
log command returns an exit status of 65.
% log show --last 2s --style syslog log: warning: The log archive contains partial or missing metadata log: cannot use --last when archive metadata is missing % echo $? 65
What I want to happen is something similar to what I get when I use the
--start option with a timestamp in the recent past. The successful command returns an exit status of 0.
% date Fri 10 Jan 2020 18:43:56 PST % log show --start "2020-01-10 18:44:00" --style syslog log: warning: The log archive contains partial or missing metadata Skipping info and debug messages, pass --info and/or --debug to include. Timestamp (process)[PID] 2020-01-10 18:44:04.459968-0800 localhost xpcproxy: (libsystem_info.dylib) Created Activity ID: 0x1f9010, Description: Retrieve User by ID 2020-01-10 18:44:04.460147-0800 localhost xpcproxy: (libsystem_info.dylib) Created Activity ID: 0x1f9020, Description: Retrieve User by ID …[snip, remaining output elided]… % echo $? 0
How can I get the log archive to contain sufficient metadata so that
log show --last 2s works as I want it to?
This is observed on macOS High Sierra 10.13.6. My account has administrator access, which the
log command requires to return any content. The access is demonstrated by the
log --start command succeeding.