Everywhere you look, there’s now at least one if not many UUIDs. Open System Information, and there’s your Mac’s Hardware UUID. The log is full of them, with each entry giving at least three, including the UUID of the last macOS boot. There are countless folders named by UUID, and entries in databases. Why, and what can you do with them?

Mere numbers

UUIDs are actually 16-byte long numbers, in C an array of 16 unsigned chars, although they’re normally expressed in a standard format of characters representing hexadecimal digits. Formerly known as Globally Unique Identifiers (GUIDs), a term still current in some of their uses, they’re now officially Universally Unique Identifiers, or UUIDs, and governed by Open Software Foundation, ISO/IEC, and IETF standards.

UUIDs are currently used to identify a huge range of different entities, both hardware and software, on Macs and most other computer systems. This is because there are so many possible values for a UUID that they are each effectively unique, assuming you use a software generator for them, rather than making them up yourself.

When presented for human use, they’re normally given as 32 hex digits displayed in five groups, with hyphens separating each group:
1234a678-1b34-1c34-1d34-1234567890ab

The first two groups of 8+4 hex digits and part of the third and fourth groups of 4 hex digits may give the time at which the UUID was issued. The third and fourth groups of 4 hex digits may give a version and variant of the UUID being used, and the final 12 hex digits can contain a ‘node id’, which might be a MAC address, for example. Unfortunately, there are several variants in common use, but all are given in the same representation, and all are assumed to be unique in some way.

There’s one fixed UUID you should never use: the nil UUID of
00000000-0000-0000-0000-000000000000

Although UUIDs should be globally unique, there’s no local or global registry of issued UUIDs. Only in certain applications does anyone keep records of the UUIDs in common use.

Where are they used?

Much of macOS’ most important internal information is now stored in SQLite databases containing a UUID as a field, as they’re unique keys. For example, if you wanted to look at quarantine events in your user’s Quarantine Events database, one way of doing so is through the UUID of each quarantine event recorded there.

UUIDs are used extensively in storage too. When Apple introduced Intel-based Macs, it changed its disk partitioning scheme to the current GPT form. GPT stands for GUID Partition Table, where GUID is the earlier term for UUID. Each logical volume on a GPT-partitioned storage system has a file system UUID, and if it uses CoreStorage, it also has its own CoreStorage UUID, and its parent CoreStorage LVG UUID, each being unique.

Apple also uses GUIDs/UUIDs to identify disk partition types: HFS+ has the value 48465300-0000-11AA-AA11-00306543ECAC, and its equivalent for an APFS container is 7C3457EF-0000-11AA-AA11-00306543ECAC, while APFS volumes contain their own GUID in their volume superblock. When you’re working with commands for CoreStorage and APFS, you may well find yourself having to supply a UUID/GUID as one of the parameters, as they’re often the only effective way of specifying volumes and other entities.

You’ll find UUIDs being used in various types of message, Bluetooth (with its own CBUUID too), ACLs, and they pervade the object systems used to develop software for macOS.

UUIDs are used as part of Uniform Resource Names, URNs, where they would be given as
urn:uuid:1234a678-1b34-1c34-1d34-1234567890ab
They can be embedded in a Uniform Resource Identifier (URI) too, as they are with printers connected to your Mac.

The Unified log

UUIDs for processes that originate events (processImageUUID) and senders that originate events (senderImageUUID) are recorded in the macOS Unified log, as is the UUID of the last macOS boot event. The snag with trying to use UUIDs of processes in the log is that there is no easy way to look up which process has which UUID, as far as I’m aware. Activity Monitor doesn’t currently give any UUIDs for the processes it lists, which is a surprising omission. However, if you wanted to analyse log entries using a spreadsheet or database, using UUIDs would be far better than trying to parse the paths of processes given in processImagePath and senderImagePath.

Do it yourself

It’s easy to generate a UUID in Terminal: simply type
uuidgen
and that command tool will return a fresh UUID as its response, neatly formatted using the standard layout. There are also equivalent calls available to software through the UUID structure in the macOS Foundation API. You can use those to verify that UUIDs generated close together in time are actually very different indeed.