Console.app and Find/Search/Filter

> I have a log file that is backed up. I am just trying to find the spot in the log where something happened. I guess I will use something else.

grep and Terminal.app is your friend here.

grep will search a file for a text string and return all matching lines. For this it needs two arguments - the string to look for, and the file to search in, so open Terminal.app and run something like:

grep EVENT /path/to/some.log

this will look in the file /path/to/some.log and find all matches of the string 'EVENT'.

There are also many switches you can use with grep to show the surrounding data - for example, the -A switch will show a set number of lines after the match (useful if you want to see the events that happened immediately after the search line):

grep -A 5 EVENT /path/to/some.log

Does that help?

johnnyjackhammer wrote:

I have a log file that is backed up. I am just trying to find the spot in the log where something happened. I guess I will use something else.

I was just searching for a replacement when you replied. lnav appears to be decent, and I haven't used it yet.

I'm not sure what you mean by "log file". Perhaps you should be more specific about exactly what you are doing.

Here's the problem. Apple devices really don't have "log files" in that sense any more. There are still a few, ancient legacy log files, but ignore those. They don't have any meaningful data. When you run Console and start "streaming", you are looking at data from Apple's new "unified logging system". There are no traditional log files in this new system. Console is useless, and in many cases, worse that useless. But it only shows you data from when you clicked on the "start streaming" button. There is a command line tool, named "log", that can show you all of the log data. It can be extremely difficult to use. You'll have to learn the custom query language for it. Plus, if you haven't already installed a special configuration profile, much of your log data will be redacted.

That's why I asked you first what you were trying to accomplish. In many cases, people come here to the forums and ask a question only when they are already well within a pointless rabbit hole. They've really lost the point by that point. But when modern Mac logging is concerned, the rabbit hole is more of a city block-sized sinkhole. To be blunt, you'll never find that spot. Once you get down deep enough, you realize that there are literally hundreds of log entires across the entire system posted every second.

It really doesn't matter what you are trying to accomplish, Console and the logging system will NOT get you there.

Don't use Console. It has virtually no value at all. It only displays the log messages while you have it enabled. So you'll never be able to search the entire log.

What are you trying to accomplish at a high level? It really doesn't matter what you are trying to do. Console is the wrong approach.