Version 2.3 of Consolation addresses a number of issues in the
log show command which it uses to obtain log extracts. These work around bugs and gaps in the documentation of
log show, and bugs in the handling of predicates by
log show. This new version also has an updated Help book which reflects these improvements.
In particular, these fixes allow users to employ search predicates which use
eventType patterns. Previous versions were unable to deliver any results using those because of syntax limitations in
log show. However, these changes to the formation of predicates should make the results of all filters/searches significantly more reliable.
The latest release is available from Downloads above.
I am very grateful to @JPoForenso who provided essential information on some details of these predicates, which enabled me to solve these multiple issues.
One issue which has been raised is that of reading
tracev3 log files. Currently, Consolation is only able to read log files which conform to the requirements of the
log command. These include the live system log on the Mac on which you are running Consolation (the default), and logarchive bundles generated by
log or Consolation. They could also include .tracev3 files (this is not yet implemented in Consolation), but Apple limits those to files which are contained within a valid logarchive bundle. As that requires a logarchive bundle, I do not currently intend adding that feature to Consolation.
Some users, particularly those engaged in forensic analysis, want to be able to analyse any
tracev3 file, including those not part of a logarchive bundle. As Apple does not document the
tracev3 format, and no one appears to have been able to break into it, that doesn’t currently appear possible, I’m afraid.