Several of my apps here – notably T2M2, Cirrus, and of course Consolation itself – access the macOS unified log. Every once in a while, that doesn’t work, and the app either shows empty data, or an error alert. This article explains what to do next.

In theory, any returned error code should enable you or me to discover the problem. In practice, they usually help little, because few can be traced to a cause which makes sense. Such is the nature of error codes in macOS.

Are you an Admin user?

The most common cause of errors when using apps which access the log is running not as an admin user, but as a regular user instead. During the lifetime of Sierra, Apple decided that ordinary users shouldn’t be able to access log entries, and ever since you have to be running as an admin user in order to extract any entries from the log.

However, attempting to access the log as a regular user doesn’t return an error, you simply get an empty result. If you’re trying to check Time Machine or iCloud, this can mislead, as you could think that there was something wrong with them. So your first check in the event that a log-based app doesn’t work is to ensure that you’re a full admin user.

Regular users can run T2M2 and Consolation using another tool, RunT2M2 or RunConsolation, provided that they already have the main app installed in the main Applications folder. They simply launch the app with elevated privileges.

When you’re confident that you are trying to view the log as an admin user, the next decision depends on whether the Mac has Time Machine enabled.

Is Time Machine enabled?

If your Mac has Time Machine enabled, and has been running for more than a couple of hours since it was last shut down (so that there are Time Machine entries in the log), there is a very quick and simple test which you can do.

Download the current version of Consolation 3 from Downloads above, if you don’t already have it installed. Open the app, and with its default settings, change the Period to read 2 hour rather than sec or min. Then click on the Get log button. You should see the last two hours of Time Machine log entries appear in its scrolling view.

No Time Machine

If Time Machine isn’t running automatic backups every hour, or you have only just started your Mac up, looking for its entries in the log over the last two hours is going to be fruitless. The best solution then is to view all log entries for a short period of time instead.

In the Filter section, click on the other text radio button, then set the Period to read 1 min; if you make that much longer, you could be overwhelmed with entries. Then click on Get log.

Results

If you see text log entries as the result of either of those two tests, this proves that your log system and the log command are working properly. Go back to the app which caused the error, and try again, looking carefully at its documentation to check that you’re not doing anything wrong.

If you see no log messages at all, then the most probable cause is that you are logged in as a non-admin user. Otherwise, that or an error number given in an alert are likely to indicate a failure in the log command or the log system.

Next check whether there are logs on the startup volume of your Mac, by looking in /var/db/diagnostics, where you should see folders with names such as Persist, Special and timesync. Inside the Persist folder, there should be several or many files with names like 0000000000000572.tracev3.

You can also check the live streaming log using Console, but beware as this uses a different mechanism for obtaining its log messages. It is quite possible for Console to work normally, but no entries to be saved to the log files where log, Consolation, T2M2, and others access them.

The only way to fix such problems is to re-install log, logd, and other components of the log system. In Sierra and High Sierra, the easiest way to do that is to download and install the latest Combo updater. If that doesn’t fix it, or you’re running Mojave, then you’ll need to re-install macOS. If you do that and your Mac still won’t write its logs properly, you need to contact Apple support.