Log window

Open a Log window using the Open Log Window command in the Window menu. Cirrus provides three rows of controls at the top of this window:

Start provides the start date (as YYYY-MM-DD) and local time (as HH:MM:SS) for the start of the log extract created when you click on the Get log button.

End provides the end date and local time (same formats as Start ) for the end of the log extract created when you click on the Get log button.

The Remove privacy checkbox determines whether the default privacy setting applies to all future log entries. When unselected, the default privacy rule applies, which replaces much of the log entries with <private>. When ticked, that protection is removed, and almost all log entries should reveal their private data. This setting remains in force until you change it, and is applied to all log entries made at that time (not retrospectively) until changed. Whatever changes you make to this checkbox are reflected in all Cirrus’ open windows, and this setting can be changed in any of Cirrus’ open windows. ⚠️ You are strongly recommended to deselect this before quitting Cirrus, to ensure that the default setting is restored. ⚠️ Apple has disabled access to this undocumented feature in macOS Catalina. When running Cirrus in 10.15 and later, this checkbox is disabled and hidden.

The CloudDocs , CloudKit , MMCS , and Other checkboxes set whether log entries from those subsystems are shown in the text output area. These don’t determine whether those log entries are collected, only whether they are displayed and saved to file.

Get log obtains an extract from the log for the set period, and displays its messages in the lower text output view in the system monospace font. Change the size of the text in the output view using ⌘ + (Command-plus) to make it one point larger, to a maximum of 24 points, or ⌘ – (Command-hyphen) to make it one point smaller, to a minimum of 4 points. This size is saved as the default for the next time that you open Cirrus, as is the window size and position.

Save opens a file save dialog in which you should select a file into which to save the current contents of the text output in the large scrolling text area. These are saved in RTF format to preserve their colour coding.

Below the buttons is the scrolling text output area . You can copy from that, or save using the Save button.

Default dates and times are set to capture logs for a period of one minute prior to opening the log window.

Four types of log message are displayed:

from the com.apple.clouddocs subsystem, displayed in black/white, controlled by the CloudDocs checkbox,

from the com.apple.cloudkit subsystem, displayed in red, controlled by the CloudKit checkbox,

from the MMCS subsystem, displayed in blue, controlled by the MMCS checkbox,

those from cloudd and bird processes and the kernel, displayed in green, and controlled by the Other checkbox.

Those checkboxes do not affect the log entries collected by or stored in Cirrus, only the display of those types of log message. They also determine what is saved when you save the output view to an RTF file: types which are not displayed are not saved in the file.

Removing privacy from the log is a significant step, in terms of its effect on log entries. This is performed using the undocumented command

log config --mode 'private_data:on'

which requires elevated privileges, so is handled through an AppleScript call, which displays the dialog below.

To enable changes to privacy, you must authenticate there using your admin user name and password. If you do remove privacy from log entries, remember to enable them again before quitting Cirrus. If you forget, you can always restore the default setting in Terminal using

sudo log config --mode 'private_data:off'

and authenticating.

Each log entry is displayed in the following fixed format:

YY-MM-DD HH:MM:SS.sss [subsystem] eventMessage

where [subsystem] is the name of the subsystem, e.g. CloudDocs, the process (either cloudd or bird ), or [other].

Open as many Log Windows as you wish. Close them using the normal red Close button on that window.

This feature is only available when you are logged in as an admin user; each time you open Cirrus. it checks that the log is available, and reports any problems it encounters, with suggested fixes when possible.

➜ test your iCloud

➜ how Cirrus works

➜ oddities, and more information

➜ back to welcome

The Eclectic Light Company – https://eclecticlight.co