Announcement: Upgrade to macOS Mojave

With features like Dark Mode, Stacks, and four new built-in apps, macOS Mojave helps you get more out of every click. 
Find out how to upgrade to macOS Mojave > https://support.apple.com/macos/mojave

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Question:

Question: Sierra wake reason syslog location?

I'm running OSX 10.13.3. I understand that if I run the following command in terminal I will get the wake reason for my machine.


log show --style syslog | fgrep "Wake reason"


Can someone please explain where this information is being pulled from? Is there a specific log file with this information? Or is it buried somewhere in an ASL database file?


Currently when I run the above command in terminal it gives me information dating back to 2/17/18. I have cleared all data in my log files, including: private/var/log; user/Library/Logs; Macintosh HD/Library/Logs. I would have thought the wake reason would have been contained in the system.log file. But clearly it's not, since even after deleting that file and rebooting, the above command still continues to list information dating back to 3 weeks ago and the system.log file only contains data from the time the file was re-created.


Thank you.

Posted on

Reply
Question marked as Solved
Answer:
Answer:

Update/answer: syslog files are now part of Unified Logging, stored here:

/var/db/diagnostics/

/var/db/uuidtext/


reference here for more info:

https://eclecticlight.co/2017/09/23/sierras-unified-log-evolves-more-persistent- and-a-valuable-log-log/

https://www.mac4n6.com/blog/2016/11/13/new-macos-sierra-1012-forensic-artifacts- introducing-unified-logging

https://developer.apple.com/documentation/os/logging?language=occ


Use terminal and the "log collect" command to collect records and export them to disk. Use "log show" to review. Must be logged in as root in terminal.


Example:

log collect --start "2018-03-05" --output /Users/username/desktop/mylogs.logarchive

log show /Users/username/desktop/mylogs.logarchive


Finally, to narrow down wake reason search, use date commands:

log show --style syslog --start "2018-03-07" | fgrep "Wake reason"

Posted on

Page content loaded

Question marked as Solved

Mar 10, 2018 6:56 AM in response to ctc1 In response to ctc1

Update/answer: syslog files are now part of Unified Logging, stored here:

/var/db/diagnostics/

/var/db/uuidtext/


reference here for more info:

https://eclecticlight.co/2017/09/23/sierras-unified-log-evolves-more-persistent- and-a-valuable-log-log/

https://www.mac4n6.com/blog/2016/11/13/new-macos-sierra-1012-forensic-artifacts- introducing-unified-logging

https://developer.apple.com/documentation/os/logging?language=occ


Use terminal and the "log collect" command to collect records and export them to disk. Use "log show" to review. Must be logged in as root in terminal.


Example:

log collect --start "2018-03-05" --output /Users/username/desktop/mylogs.logarchive

log show /Users/username/desktop/mylogs.logarchive


Finally, to narrow down wake reason search, use date commands:

log show --style syslog --start "2018-03-07" | fgrep "Wake reason"

Mar 10, 2018 6:56 AM

Reply Helpful
User profile for user: ctc1

Question: Sierra wake reason syslog location?