Last Week on My Mac: Where next with the log?

It’s coming up to two years since I returned to Mac software development after a break of over fifteen years. I hadn’t stopped coding, but faced with the prospect of using Objective-C, I had hidden away with more eloquent languages like Common Lisp, working on personal projects.

What drove me back to development was the release of macOS Sierra, or to be more precise its Console app and the shockingly limited features for accessing the new unified log. What had been one of the most important tools for investigating problems, and discovering what goes on in macOS, had suddenly been pulled from under us.

Within a few weeks I had thrown together my first AppleScript which put a simple front-end on the log command tool, and called it LogLogger.

loglogshot3

Consolation first appeared a few months later, in February 2017, and was my baptism by fire in Swift. Instead of dumping log excerpts out into text files, it now displayed them in its own window.

consolscript20

In October 2017, I tried a different approach with Woodpile. Instead of working from individual log entries up, and getting lost among the trees, Woodpile uses the statistical summaries generated automatically by logd when log files are rolled to storage so that you can browse from the top down. I have found it a fascinating tool for looking at performance issues, and much more.

woodpile35

Consolation 3 is now about as complex as I want it to get. If you use it fairly regularly (or write it!), you’ll have found that it can do things that no other log tool does. But for the occasional user, it has a lot of confusing controls to cope with, and looks daunting, to say the least. It’s been a popular download here, but only a small fraction of those who used Console in El Capitan could have switched to Consolation in Sierra and beyond.

consol351

That means that there are still plenty of Mac users out there who used to browse their logs before they went unified, who are either happy with the new Console (really? how?), or who have simply given up trying to access the log since they upgraded to Sierra. My own experience in supporting Mac users is that the latter is much more likely.

If Console, Consolation, and Woodpile aren’t the best answer for all those potential log users, what is? Simply trying to reinvent the old Console for the new log isn’t of any help: the unified log is so different that a traditional approach is simply a non-starter. I and many others moaned about El Capitan’s cluttered logs; Sierra’s log is at least an order of magnitude worse, and not infrequently clocks up 10,000 log entries in a minute – something for which the old Console is completely unsuited.

Since Consolation 3, I have incorporated limited log interfaces in some other apps such as Cirrus, which don’t confront the user with a huge array of controls to accommodate every possible option. My latest example is RouteMap, which opens up access to the new Signposts in High Sierra and Mojave.

I’m now inclining towards supporting more specific tools which have the same power, but which tuck all the search predicate stuff out of the way. The idea is to provide an extensible library of predicate and other settings which can be selected from a popup menu, leaving the user to concentrate on selecting time periods and the like. Those could be assisted by a histogram of message frequencies by time period, much in the way that Woodpile offers.

So, for a simple example, if you wanted to check Time Machine entries, you’d select that from a popup menu, which would determine the search predicate to be used. All you need to specify then if the time period over which you want to view entries. Most of the controls currently puzzling people in Consolation would be set as options within the popup menu items, freeing most users from having to work out how to construct a search predicate.

I also haven’t come across any other log browsers for the macOS unified log, which may just reflect my ignorance. What are people using instead of Console, and why?

If you use Consolation or another log browser, or are put off trying to access the unified log, please make your views known here. We can discuss them, and they can help me formulate the way ahead so that you get the tools that you need, and will use.