Over the holiday period, I’ve found more time to make progress with Ulbow, my new browser for the macOS unified log, supporting macOS Sierra, High Sierra, Mojave and Catalina. This includes some important design decisions, improving its human interface, and a fair bit of coding. I’m delighted to report that I now have an early development version running, already extracting entries from the log.

One of the biggest issues with Consolation is its forbidding interface, with so many popup menus and other controls. This not only takes up too much of each window, but makes it too easy to get those controls wrong, and end up with hundreds of thousands of irrelevant log entries, or none at all. Then to run away screaming.

Ulbow reduces all those controls to two simple rows:

• the top row offers three combo controls, in which you can select a filter predicate to determine which entries are extracted, a message filter which also supports regex, and the style in which entries are displayed;
• the second row, in which the time period is set using simplified controls, with the Get log button to fetch the desired entries.

Predicates, filters and styles are then edited in its separate Preferences window. Standard sets will be provided to support the most common tasks, including checking Time Machine, iCloud, and privacy controls. Options such as whether to include Signpost entries are now placed in menus rather than cluttering up the window.

The most difficult decision has been how to obtain these log extracts. As announced at WWDC 2019, Apple has finally introduced direct programmatic access to the unified log in Catalina, but it has some significant drawbacks. Most importantly, this isn’t retrospective: the framework doesn’t support versions of macOS earlier than 10.15, which would lock out many who currently use Consolation. It also doesn’t appear to work with saved logarchives, another major limitation. I have therefore decided to stick to using the command tool log and its verb show, as in the current version of Consolation.

I’ve devoted a lot of time and thought to how best to set the time interval for which to capture log entries. Consolation currently offers two different systems, a period up to the present, and explicit start and end times. Ulbow instead uses a time reference, and a period from that moment. If you want to view log entries for Time Machine over the last hour, click on the Now button to set the reference to the present, then set the period to -1 hour. If you want to study what happened in the minute following an incident which happened at 0200 this morning, set the reference to 02:00:00, then set the period for 1 minute. I can’t see any more efficient and flexible control, but if you have a better idea I’m open to all suggestions.

At least in early releases, I don’t intend supporting the following features which remain available in Consolation:

• opening logarchives or individual log files, which will be added a bit later;
• standard styles such as syslog, default and JSON, for which there are better custom styles;
• export in CSV format, which will come later if there’s any demand.

Without making any promises, I hope that the first public beta of Ulbow will be available here in the next week or two, once I have added sufficient controls and options to give it comparable flexibility to the current release of Consolation.