Since its introduction in macOS Sierra, the unified log has become steadily more complex and, on occasions, significantly less reliable. This article releases updates to six of my free utilities so that they negotiate these problems better, and save you wasted time when your log isn’t working as expected.

The first problem introduced with the unified log, in macOS 10.12, is that it’s only accessible when the current user has admin privileges. This wasn’t the case with the traditional logs, and what’s worse is that the log show command, used to obtain extracts from the unified log, doesn’t return an error if the user hasn’t got admin privileges, it simply doesn’t return any extracts. Apps of mine which rely on obtaining log extracts therefore check whether the current user has those privileges; if they don’t, the app warns and quits when necessary.

The next problems arise when something has gone wrong with the log, and it isn’t collecting the correct files to enable the log show command to work. While traditional log files are just text, in the unified log entries are stored in compressed binaries in a proprietary format. Those apps which rely on their existence now check that major component files of the log system are available. If they aren’t, they warn of the missing components and their consequences.

The second check is for log files themselves, in the /var/db/diagnostics/Persist folder.

The third check is for special timesync files in /var/db/diagnostics/timesync which support conversion between the different clocks used.

Having established whether the right files exist, these apps pass on to the fourth check in which they try to obtain a basic extract using the log show command.

If that doesn’t work, they again warn of the problem and its consequences before passing on to the fifth and final check. This determines whether the time format used in both the log show command and the log entries is in the correct 24-hour format. This addresses a problem which has been recently introduced into Big Sur, in which setting your Mac’s wallclock to 12-hour format substantially changes how time values are formatted. I’ll be writing more about that later this week, when I’ve had a better chance to establish exactly what’s going wrong in 12-hour format.

Of all the problems, this is the simplest to solve, by opening the Language & Region pane and there setting the Time format to 24-Hour Time. That can be performed without quitting the app, as its effects are immediate.

Each of my utilities which provides log access now has an update in which these tests are applied in sequence each time that the app is opened. I hope this will reduce the chances of those apps not working optimally.

Here are the new versions, each of which is also available from Downloads above, from their respective Product Pages, and through their auto-update mechanism:
Consolation 3: consolation312
Ulbow: ulbow16
Mints: mints12
T2M2: t2m2117
Cirrus: cirrus111
Taccy: taccy113

This new version of Cirrus no longer supports El Capitan, I’m afraid. If you wish to continue using Cirrus with macOS 10.11, please stay with the current version, 1.10.

I hope that these new versions make your access to the log more reliable and less of a gamble.