Analysing entries in Sierra’s live unified log is all very well and good, but a lot of the time you want to investigate a specific period in time. It might be a restart, startup, a crash when waking from sleep, or an app unexpectedly quitting.

My second beta-release of Consolation 2.2 makes it even easier to do that without having to resort to commands in Terminal: this version can now export logarchives which contain all log entries for a set period, then you can analyse them at your leisure.

This morning, after just a couple of days of continuous running, dispatching fell apart once again and I had to restart my Mac. I also wanted to take the opportunity of capturing all log entries prior to and after that restart. At the time, the best way of doing that was to type
sudo log collect --last 5m
into Terminal. This gave me the idea of building this into Consolation.

The principle is simple: with any window open in Consolation, set the Period to the length of log which you want to extract, such as 5 minutes. This is quickly done by typing 5 into the Period text box, pressing Tab to enter that number, then pressing the M key to set the units popup to minutes. Then click on the new Write logarchive button.

You are then prompted to locate and name the new logarchive bundle which Consolation will save for you. Once that is set, macOS will prompt you to enter your admin password, as this command must be run as root.

A few seconds later, the text immediately below the button controls displays the full path and name of the logarchive bundle which has just been saved. If you then want to open that immediately, click on the file radio button at the top, in the new Log source section. You will then be asked to locate that logarchive file, and it will be opened for you to analyse and search as you wish.

There is one limitation to beware of: because Consolation does this using AppleScript, it has to pass the path and filename as a string within single quotes, e.g.
‘/Users/myname/Documents/Crash log.logarchive’
Unfortunately, this means that the path and filename must not contain single or double quotation characters, although they can contain any other characters which are acceptable to macOS.

Working on logarchives is much easier than on a live log, as Consolation always has done in the past. This enables you to revisit important log captures for as long as you want afterwards, and I think is a major step forward for all Consolation users.

The latest release is available from Downloads above.

I hope that you find it useful.