In some Christmas traditions, presents aren’t opened until the day after Christmas Day, popularly known as Boxing Day, as that’s when you hand out gifts and gratuities, or for Apple fans, perhaps it should be Unboxing Day.

Today’s gift is a new version of my log browser Ulbow. For those who use it to generate log extracts in CSV format, it fixes an annoying bug; for all users it now provides information about the oldest log file found in the Persist folder, as I’ll explain later.

CSV export

The CSV bug has been around a long time, I’m afraid. The problem wasn’t so much Ulbow’s as one of the fields that Ulbow tried to add to every CSV file it generated, containing the formatString. This has an interesting history, going back to serious security leaks in High Sierra in 2017-18 which wrote encryption passwords into the log in plain text. This was the result of incorrect formatting of log messages, so to prevent this from occurring in the future, Apple added the formatting string used to compose each message field as another field in the log.

Unfortunately, as the formatString contains characters which are readily misinterpreted by apps when importing CSV, certain contents could make it impossible to import a log extract. The only solution is to exclude the formatString field from CSV export, which Ulbow 1.8 now does.

Log length

As I’ve written elsewhere, it has now become apparent that some Macs have very short periods covered by full log entries, some less than a day, and a few even shorter. This is an issue I wanted to address in this update. My original idea was to add an option that would prevent you from trying to browse logs that no longer existed, because their tracev3 files had already been deleted during logd housekeeping.

In practice, that isn’t a good idea, as there are usually still some log entries available long before the log started its oldest tracev3 file in the Persist folder. To see this, I first added estimation of the length of log remaining to the Check Log window available in the Ulbow menu.

This uses the same method to estimate the approximate time of the earliest Persist log entry. Gathering all log (but not Signpost) entries for a ten-minute period around that time shows how there are still some entries from well before the start of the current log files in the Persist folder.

The step increase in frequency of log entries seen to the right of centre marks the division between Special-only and full log entries. To the left the only remaining entries are those left in tracev3 files in the Special folder; to the right there are log entries in the Persist files as well.

Even voluntarily imposing a cutoff time here would mislead the user into thinking that those older log entries didn’t exist. So this new version of Ulbow provides the information but doesn’t attempt to use that to limit the logs it tries to show.

Help

Ulbow’s Help book has an extra page explaining how you can customise log preferences to extend the period covered by your Mac’s log. This brings it to a total of 37 pages.

Unfortunately, as this new version of Ulbow is built using the current release of Xcode, it no longer runs on Sierra, although it should be capable of accessing logarchives created on Macs running Sierra, when the Unified log was introduced. I will leave version 1.7 available for those who still want to run Ulbow on Sierra.

Ulbow 1.8 is now available from here: ulbow18
from Downloads above, from its Product Page, and via its auto-update mechanism.

Happy Boxing Day!