Dear Santa,

What I’d like most this Christmas, please, is a Yule log. To be precise the log in my Mac. I think I had better explain.

Over six years ago, with macOS Sierra, Apple gave us a new and Unified log, designed for all the new features that were to come over the following years, like a modern file system, robust and secure redesign of system structure, and eventually the most wonderful of all, Apple silicon Macs. As a foundational technology it enabled engineers to gather great detail about performance, problems and bugs, particularly with sysdiagnose. The cost to the user was mainly loss of access: while many had browsed El Capitan’s traditional logs, the new Console log browser locked the Unified log away from almost everyone apart from Apple’s engineers.

For those prepared to learn new ways, this new log offered riches, fine detail and deep insights into what happens inside macOS, with continuous records stretching back for twenty days or more, to begin with. Over time our logs grew more and more busy. New subsystems like RunningBoard proudly give us a blow-by-blow account of their innermost thoughts, while those more established like LaunchServices can’t be content with a back seat. More troubled features like Bluetooth and Wi-Fi just have to write extensive information to document their woes, and Universal Control doesn’t help either. Apple had catered for this, in rolling log files to control total size, rather than limiting them by age.

Until last summer, accessing the Unified log remained a minority pursuit. Many developers looked on it as a closed book full of the incessant chatter of macOS, like trying to listen for the song of a sparrow against the roar of the crowd.

Then Apple gave us another present that made our Mac’s log important, in the anti-malware scanner XProtect ‘Remediator’. As a background service, unless you’re running third-party security software that uses Endpoint Security in Ventura, the only way you can check its reports is by reading the log. Over the last few months, many Mac users have started taking great interest in what’s in the Unified log, something macOS was completely unprepared for.

Suggesting they use the only bundled log browser Console is plain daft and completely unhelpful. The only way to do that would be to save the whole of the active log as a logarchive, then fiddle around creating filter predicates that experts struggle with, to reduce the millions of log entries to the handful they want to read. Apple’s six years of failure to provide users with a fully functional log browser have bitten users back.

The embarrassing conclusion is that the only practical way for the user to read the reports of Apple’s new security protection is with third-party software.

It was then that we realised that six years of profligate overuse of this wonderful new Unified log had severely limited its usefulness too. At present, on most Macs, these anti-malware scans take place every 24 hours or so. Some Macs, particularly those running 24/7, now have such a high load of log entries that their record is too short to retain those reports for the user. Instead of the log keeping details for as long as 20 days, on some Macs it now can’t even manage 20 hours.

I know that Santa has miraculous powers to restore joy and hope to those around the world suffering from oppression. All that I ask is that Apple:

• gives the user control to increase the amount of storage to retain persistent log files,
• calls on its engineers to economise on entries written to the log, rather than paying them by the word,
• reviews default preferences for logging in release versions of macOS,
• develops Console or a successor to enable ordinary users to access log history,
• in other words, to give us back our logs.

These need not compromise the information provided to Apple’s engineers in a sysdiagnose if Apple were to provide custom log profiles to cater for different types of problem. But to leave this fire-hose of debug information in full spate while we’re trying to use release versions of macOS is doing us all a disservice.

I wish you all a Merry Christmas, and hope it’s not too late to ask for this Yule log.