Several of my apps here – notably T2M2, Cirrus, Taccy, and of course Ulbow and Consolation – access the unified log in macOS. Every once in a while, that doesn’t work, and the app either shows empty data, or an error alert. This article explains what to do next.

In theory, any returned error code should enable you or me to discover the problem. In practice, they usually help little, because few can be traced to a cause which makes sense. Such is the nature of error codes in macOS.

Are you an Admin user?

Older versions of these apps didn’t check whether the current user was an admin user, which is an essential requirement for accessing the log. Latest versions now check whether the current user is a member of the admin group (80). If not, then T2M2, Ulbow and Consolation display an alert and quit when you dismiss that, as they can’t do anything useful without log access. The other apps display an alert that access to the log feature is disabled, and then run without that feature.

Check your log files using Ulbow

The latest version of Ulbow contains a feature which checks whether the correct log files are being stored by macOS, and whether a basic log show command works properly. Note that you can’t use Console to test those: Console can’t access your Mac’s active log files directly; the log entries which it displays are streamed live from a different part of the log system, not the files which Ulbow, Consolation, T2M2 and others access.

If you haven’t installed Ulbow yet and set up its custom predicates and settings, follow the instructions to do so. Open the app, and in its app menu use the Check Log command to open a diagnostic window. In that click the Check Active Log button. Ulbow then examines the folders in which the log files should be stored, and reports back how many of them it finds, and how many items each contains. It then runs a basic log show command which should return a few hundred log entries, and reports whether that completes without error.

On a normal Mojave or Catalina system, you should see a report containing something like:
Check of log files at /var/db/diagnostics:
There are 10 items in that path.
There are 52 files in the Persist folder.
There are 197 files in the Special folder.
There are 169 files in the Signpost folder.
There are 8 files in the timesync folder.
There are 257 folders in the /var/db/uuidtext folder.

log show --last 2 command returned 238 log entries.
The log show command appears to be working correctly.

Earlier versions of macOS don’t normally have a Signpost folder, as those versions of the unified log don’t support that feature. Otherwise, the absence of any of those folders indicates that the log system on that Mac isn’t functioning properly, and you may not be able to retrieve log entries.

One problem which I have come across on a few systems is that some attempts to get log entries succeed, but others fail. Typically, T2M2 doesn’t work, but Ulbow does. This can result from corruption to, or absence of, files in the timesync folder. T2M2 uses a log show command which calls for the last few hours of the log, which is dependent on accessing these additional time records. Ulbow, though, uses a slightly different call which specifies start and end times, which should prove more robust.

Fixing log problems

The only way to fix such problems is to re-install log, logd, and other components of the log system. The easiest way to do that is to download and install the latest Combo updater for your current version of macOS. If that doesn’t fix it, then you’ll need to re-install macOS itself. If you do that and your Mac still won’t write its logs properly, you should contact Apple support.

Because log files are rotated and old ones removed, a problem with the log today may vanish by next week, when a currently damaged file is removed in logd‘s routine housekeeping. If you don’t need your current log files, you can always delete them using
log erase --all
but unless you can make and save a logarchive of what is there at present, all those previous log entries will be permanently lost.