Retain Console System.log Events file for Usage Analysis

Question

Retain Console System.log Events file for Usage Analysis

I recently became interested in tracking the usage of some Apple computers. I discovered that the system.log events file in Console provides the login and logout times. So, I was able to use that to calculate how much time the computers are being used. This was very handy because there was data from October 2010 to June 2011. I went back a few days later and discovered the log files had been purged all except a few weeks of data. Is there any way to prevent them from being purged? Or, can I increase the size of the retained system.log file? What's the point of a log file tracking events if it's only going to be deleted? Alternatively there are programs designed to keep track of computer usage such as login and logout times as well as user usage by application. Would you recommend one of these?

 24" iMac 2.8 GHz  MacBook Pro  24" LED Display  iPhone 4, Mac OS X (10.5.4),  iPad  8-Cor Mac Pro

Posted on Jun 20, 2011 7:27 AM

Reply

Answer 1

Jun 21, 2011 11:15 AM in response to resourcesforlife.com

In the folder /private/var/log look for files named system.log.0.bz2, system.log.1.bz2, etc. These are compressed older log files. It's not necessarily reasonable for log files to be kept forever. These can become quite large. Your best approach is to capture the login-logout lines periodically and let the log files be deleted as the system is inclined.

Reply

Answer 2

Jun 21, 2011 12:00 PM in response to William-Boyd-Jr

William, Thanks for your reply. Yesterday I grew impatient -- not having found an immediate solution on the Internet anywhere, so I did some research into this issue.

The problem is that the archived system.log files are erased every night a midnight (the oldest one) by default. So, the most a person would have is about a week's worth. I'm wanting 6 months or more of log files.

So, I wrote up this article describing how to program the computer to retain information over a longer period of time: http://www.resourcesforlife.com/docs/item4113

Of course, the other issue is that the bz2 file format appears to be a compressed file needing a special utility to open and view it. So, I wrote up this article describing how to get around the problem of being unable to open the archive files: http://www.resourcesforlife.com/docs/item4114

Reply

Answer 3

Jun 21, 2011 7:58 PM in response to resourcesforlife.com

Interesting...

Some notes:

1) There's a typo ("ect") in that first document.

2) You can hope that you never have a system problem that causes large numbers of messages. The change you made would risk having log files fill up the disk if that happened or if enough time passed.

3) I had no trouble opening a ".bz2" with StuffIt Expander or with the default Archive Utility.

4) The best solution for what you want to do is a script that runs daily to extract the login and logout messages from those log files. With that there would be no need to keep large volumes of log files.

Reply

Answer 4

Jun 22, 2011 12:43 PM in response to William-Boyd-Jr

Thanks for bringing the typo to my attention. I've corrected that now. I'm reminded of the phenomenon by which we see and read words as groups of letters regardless of their positioning.

I've not really had any specific system problems that cause huge log files. However, sometimes when diagnosing problems it's nice to have a long period of time to examine possible issues.

Regarding your #3, opening .bz2 files... Have you saved these log files from Console and then tried opening them? It's just bazaar. The file opens to another file, then opens to another file, and so on. You never see the actual file contents. Others have observed the same thing.

Regarding your #4, I created the script you mention. It's described here:

http://www.resourcesforlife.com/docs/item4103

However, I'd like to just go ahead and use the existing system.log events.

Greg

Reply

Answer 5

Jun 22, 2011 12:45 PM in response to resourcesforlife.com

resourcesforlife.com wrote:

Regarding your #3, opening .bz2 files... Have you saved these log files from Console and then tried opening them?

No. I just copied them from /private/var/log to the Desktop.

Reply

Answer 6

andyBall_uk

Level 7

20,526 points

Jun 22, 2011 1:08 PM in response to resourcesforlife.com

the bz2 files aren't special, they're plain text as you've seen. Console-File-Save a copy as... saves the log file uncompressed, by default with the same name as the original - even when that name includes the bz2 extension.

So just lose the extension.

Reply

Answer 7

Jun 22, 2011 1:37 PM in response to andyBall_uk

Thanks, William, for your help and feedback. I appreciate that. Also, thanks to Andy for clarifying about the bz2 files. That makes sense that the originals might be compressed, but Console saves them as text files, yet leaves the original file name and extension. That would explain why the various programs I tried wouldn't uncompress them -- because there was nothing to uncompress. Changing the extension, then, is what I finally stumbled on (also Andy's recommendation).

Reply