In the folder /private/var/log look for files named system.log.0.bz2, system.log.1.bz2, etc. These are compressed older log files. It's not necessarily reasonable for log files to be kept forever. These can become quite large. Your best approach is to capture the login-logout lines periodically and let the log files be deleted as the system is inclined.
William, Thanks for your reply. Yesterday I grew impatient -- not having found an immediate solution on the Internet anywhere, so I did some research into this issue.
The problem is that the archived system.log files are erased every night a midnight (the oldest one) by default. So, the most a person would have is about a week's worth. I'm wanting 6 months or more of log files.
Of course, the other issue is that the bz2 file format appears to be a compressed file needing a special utility to open and view it. So, I wrote up this article describing how to get around the problem of being unable to open the archive files: http://www.resourcesforlife.com/docs/item4114
1) There's a typo ("ect") in that first document.
2) You can hope that you never have a system problem that causes large numbers of messages. The change you made would risk having log files fill up the disk if that happened or if enough time passed.
3) I had no trouble opening a ".bz2" with StuffIt Expander or with the default Archive Utility.
4) The best solution for what you want to do is a script that runs daily to extract the login and logout messages from those log files. With that there would be no need to keep large volumes of log files.
Thanks for bringing the typo to my attention. I've corrected that now. I'm reminded of the phenomenon by which we see and read words as groups of letters regardless of their positioning.
I've not really had any specific system problems that cause huge log files. However, sometimes when diagnosing problems it's nice to have a long period of time to examine possible issues.
Regarding your #3, opening .bz2 files... Have you saved these log files from Console and then tried opening them? It's just bazaar. The file opens to another file, then opens to another file, and so on. You never see the actual file contents. Others have observed the same thing.
Regarding your #4, I created the script you mention. It's described here:
However, I'd like to just go ahead and use the existing system.log events.
Thanks, William, for your help and feedback. I appreciate that. Also, thanks to Andy for clarifying about the bz2 files. That makes sense that the originals might be compressed, but Console saves them as text files, yet leaves the original file name and extension. That would explain why the various programs I tried wouldn't uncompress them -- because there was nothing to uncompress. Changing the extension, then, is what I finally stumbled on (also Andy's recommendation).