They crop up everywhere on your Mac now: System Information offers you a hardware UUID, UUIDs for each printer embedded in their URI, volume, LVG, and PV UUIDs for your storage, and Thunderbolt domain UUIDs. Browse your log and every entry has two UUIDs, and some give you even more. Why, and what can you do with them?

Mere numbers

UUIDs are actually 16-byte long numbers, although they’re normally expressed in a standard format of characters representing hexadecimal digits. Formerly known as Globally Unique Identifiers (GUIDs), a term still current in some of their uses, they are now officially Universally Unique Identifiers, or UUIDs, and are governed by Open Software Foundation, ISO/IEC, and IETF standards.

UUIDs are currently used to identify a very wide range of different entities, both hardware and software, on Macs and many other computer systems. This is because there are so many different possible values for a UUID that they are effectively unique. That assumes, of course, that you use a software generator for them, rather than making them up yourself.

When presented for human use, they are normally given as 32 hex digits displayed in five groups, with hyphens separating those groups:
1234a678-1b34-1c34-1d34-1234567890ab

The first two groups of 8+4 hex digits and part of the third and fourth groups of 4 hex digits give the time at which the UUID was issued. The third and fourth groups of 4 hex digits also give a version and variant of the UUID being used, and the final 12 hex digits give a ‘node id’, which can be a MAC address, for example. Unfortunately there are several different variants in common use, but all are given in the same representation, and all are assumed to be unique.

There is one fixed UUID which you should never use: the nil UUID of
00000000-0000-0000-0000-000000000000

Although UUIDs should be globally unique, there is no local or global registry of issued UUIDs.

Where are they used?

Much of macOS’ most important internal information is now stored in SQLite databases, which contain UUIDs as a field, as they are unique keys. For example, if you want to look at quarantine events in your user’s Quarantine Events database, then one way of doing so is through the UUID of a quarantine event recorded there.

UUIDs are used extensively in storage too. When Apple introduced Intel-based Macs, it changed its disk partitioning scheme to the current GPT form. GPT stands for GUID Partition Table, and GUID is the former term for UUID. Each logical volume on a GPT-partitioned storage system has a file system UUID, and if it uses CoreStorage, it also has its own CoreStorage UUID, and its parent CoreStorage LVG UUID – each being unique.

Apple also uses GUIDs/UUIDs to identify disk partition types: HFS+ has the value 48465300-0000-11AA-AA11-00306543ECAC. Apple hasn’t released the standard value for APFS, but all APFS volumes also contain their own GUID in their volume superblock.

When you’re working with commands for CoreStorage and APFS, you may well find yourself having to supply a UUID (GUID) as one of the parameters, as they are often the only effective way of specifying volumes, etc.

You’ll find UUIDs being used in various types of message, Bluetooth (which has its own CBUUID too), ACLs, and they pervade the object systems used to develop software for macOS.

UUIDs are also used as part of Uniform Resource Names, URNs, where they would be given as
urn:uuid:1234a678-1b34-1c34-1d34-1234567890ab
They can be embedded in a Uniform Resource Identifier (URI) too, as they are with printers connected to your Mac.

Sierra’s log

UUIDs for processes that originate events (processImageUUID) and senders that originate events (senderImageUUID) are recorded in Sierra’s unified log, although you cannot view them in Apple’s Console app. They are only accessible using the log show command to return the log extract in JSON format, or using my free tool Consolation (from Downloads above), which will show them in a custom style and export them in CSV format.

The snag with trying to use UUIDs of processes in the log is that there is no easy way to look up which process has which UUID, as far as I am aware. Activity Monitor doesn’t currently give any UUIDs for the processes which it lists, which is a surprising omission. However, if you wanted to analyse log entries using a spreadsheet or database, using UUIDs would be far better than trying to parse the paths of processes given in processImagePath and senderImagePath.

Do it yourself

It is easy to generate a UUID in Terminal: simply type
/usr/bin/uuidgen
to be specific, or
uuidgen
and that command tool will return a fresh UUID as its response, neatly formatted using the standard layout. There are also equivalent calls available to software developed using Xcode.

You can use that to verify that UUIDs generated close together in time are actually very different indeed.