The log command has been evolving during High Sierra’s existence, adding new capabilities including Signposts, a feature which Apple has only just announced for macOS 10.14 Mojave. Unfortunately Apple has not kept its man page up to date, and there are now significant differences between its man page, usage information, and what log can actually do. This article looks at what has changed since 10.13 was released.

The most important command for accessing the unified log is log show. This has had several enhancements, including:

• --style now offers a fourth option of compact, in addition to syslog, json, and the default.
• --color [auto | always | none] is supposed to highlight some messages in colour, but currently refuses to take options, and doesn’t seem to work properly.
• --last boot is a new option to show the log since the last system boot.
• --timezone [local | timezone] displays entries according to the indicated timezone.
• --signpost enables the display of Signpost entries, see below.

A new and undocumented command statistics has been added, which must be sudoed to run as root. Its usage is given as
log statistics [--file path][--archive path][--filter filter]
At present, this doesn’t seem to recognise --filter, although examples given suggest that this is a simple text filter rather than a complex predicate. For example,
sudo log statistics --filter 'message:"error"'
returns an error claiming that option is not recognised.

Another summarising command which is documented is stats. This appears to be based on the log file analyses performed by logd, and is well described in its usage information. For example,
log stats --overview
displays overview statistics for a complete logarchive or system log files. You can specify the logarchive to use with --archive, sort output by number of events or size, limit output, and select the statistics to be shown by log book, file, and others.

The undocumented command to toggle privacy remains as in Sierra:
sudo log config --mode 'private_data:on'
to display all private data, and
sudo log config --mode 'private_data:off'
to hide it.

Signposts

The current implementation of Mojave’s Signposts appears to be fully functional in macOS 10.13.5, and is already being used extensively by some macOS subsystems such as com.apple.SkyLight, although it isn’t clear why this is not turned off in release versions of macOS.

To extend the unified log to support Signposts, Apple has added or extended the following keys:

• eventType – normal log entries are logEvent, activities are activityCreateEvent, and Signposts are signpostEvent;
• signpostID – a large integer ID;
• source – this appears unused at present, and set to null;
• activityIdentifier – an integer, normally 0 at present;
• parentActivityIdentifier – an integer, normally 0 at present;
• category – an existing key, normal log entries are assigned strings such as Server, session, libinfo, or memberships. Signposts are assigned performance_instrumentation, and Activities an empty string.

This confirms that Signposts are regular entries in the unified log, although log show must be used with the option --signpost in order to capture them. This is currently possible by adding that to the other text or final text box in Consolation 3. A future version will provide direct support for capturing Signposts.

Apple has not provided any further details, beyond the conflicting man page and usage information.