Lmst

#LogUI

Last Week on My Mac: Seconds out

https://fed.brid.gy/r/https://eclecticlight.co/2026/02/01/last-week-on-my-mac-seconds-out/

<p>In 1657, one of the great scientists of the Dutch Golden Age, Christian Huygens, invented the pendulum clock, the first timekeeping device accurate enough to make a second hand worthwhile, as it typically only lost about 15 seconds per day. It was another century before John Harrison developed his marine chronometer, a clock sufficiently accurate to enable precise determinations of longitude. Another hundred years later, with the coming of railways across Europe, ordinary people started synchronising clocks so they caught their train, and our ancestors soon became the first slaves to time.</p>
<p>I’m beginning to wonder whether Apple intends reversing that history. Have you not noticed something odd about setting times in more recent Mac apps, how few allow you to set the seconds? You can see what has happened over the last few years in my log browsers, Ulbow and LogUI.</p>
<p><span class="alignnone"><a href="https://eclecticlight.co/wp-content/uploads/2025/10/logfallback2.png"><img alt="" class="alignnone size-full wp-image-89166" height="149" src="https://eclecticlight.co/wp-content/uploads/2025/10/logfallback2.png" width="940" /></a></span></p>
<p>Most of Ulbow’s interface was written using AppKit seven years ago, and it uses a standard <a href="https://developer.apple.com/documentation/appkit/nsdatepicker/elementflags" target="_blank">Date Picker with elements</a> containing the year, month, day, hour, minute and second. Given that you can get more than 10,

Bạn dev? LogUI – nền tảng logging & monitoring đơn giản, bắt đầu từ dự án hobby, hiện mở beta cho mọi người. Tính năng: log thời gian thực, giám sát server & app (health endpoint, ping), cảnh báo email (cơ bản + tùy chỉnh), AI tổng hợp sức khỏe, bộ lọc tìm log & chatbot thống kê (chỉ trong gói pro), SDK NodeJS (sắp có .NET, Python). Dùng thử miễn phí 7 ngày, chào đón phản hồi. #Logging #Monitoring #DevTools #CôngCụ #LogUI #AI

https://www.reddit.com/r/SaaS/comments/1qsmcyu/i_built_a_simple_loggi

Last Week on My Mac: Signs of distress

https://fed.brid.gy/r/https://eclecticlight.co/2026/01/25/last-week-on-my-mac-signs-of-distress/

<p>Over the last few weeks, I’ve been posed a series of questions that can only be resolved using the log, such as why Time Machine backups are failing to complete. The common confounding factor is that something has gone wrong at an unknown time, but if you don’t know exactly what you’re looking for, nor when to look, the Unified log is a hostile place, no matter which tool you use to browse its constant deluge of entries.</p>
<p>This is compounded by the fact that errors seldom come singly, but often propagate into tens of thousands of consequential log entries, and those not only make the cause harder to find, but can shorten the period covered by the log. In the worst case, by the time you get to look for them, the entries you needed to find are lost and gone forever.</p>
<p>In late 2017, I experimented with a log browser named <a href="https://eclecticlight.co/2017/11/21/checking-keychain-access-using-woodpile-a-tutorial/">Woodpile</a> that approached the log differently, starting from a histogram of frequencies of log entries from different processes.</p>
<p><span class="alignnone"><img alt="keychainopen05" class="alignnone size-full wp-image-29763" src="https://eclecticlight.co/wp-content/uploads/2017/11/keychainopen05.jpg?w=940" /></span></p>
<p>Viewed across the whole of a log file, this could draw attention to periods with frequent entries indicating potential problems.</p>
<p><span class="alignnone"><img alt="keychainopen06" class="alignnone size-

ICYMI: a selection of the best Mac articles of 2025 – 2

https://fed.brid.gy/r/https://eclecticlight.co/2026/01/01/icymi-a-selection-of-the-best-mac-articles-of-2025-2/

<p>This is second of two compilations of some of my favourite articles published here during 2025. Here I move on to consider security, logs, macOS generally, Spotlight in particular, and some utilities that I hope prove useful in the coming year.</p>
<h4>Security</h4>
<p>There have been plenty of articles about different aspects of macOS security protection. Among them is this <a href="https://eclecticlight.co/2024/08/21/controlling-system-integrity-protection-using-csrutil-a-reference/">reference guide</a> to controlling SIP (System Integrity Protection) using the command tool <code>csrutil</code>.</p>
<p>No matter how careful you are, some apps seem to get stuck in App Translocation, which can result in many problems with them. <a href="https://eclecticlight.co/2025/10/16/check-if-an-app-is-stuck-in-translocation/">This article</a> explains how to tell, and what you can do about it.</p>
<p>Most recently, I have tried to harness some of the features used by macOS security to enable us to check <a href="https://eclecticlight.co/2025/12/26/use-providable-to-check-file-histories/">which apps have been changing files</a>, using my new app Providable.</p>
<h4>Logs</h4>
<p>On 26 February I released the first experimental version of my new log browser LogUI. This is the first I have written that accesses log entries directly through macOS, rather than using the <code>log show</code> command, and my first major app using SwiftUI rather than AppKit.</p>
<p><span class="alignnone"><a

Why can’t my Mac get log entries or find XProtect scans?

https://fed.brid.gy/r/https://eclecticlight.co/2025/12/15/why-cant-my-mac-get-log-entries-or-find-xprotect-scans/

<p>Several of my utilities rely on being able to read log entries from your Mac. For most, this is the only way that you’re ever going to try to access the log. For a few this draws attention to potential problems, when the app discovers it can’t access the log and reports that as an error. This article explains what those errors mean, and what you can do to address them.</p>
<h4>Log file layout</h4>
<p>Files containing log entries are stored in two main locations in your Mac’s Data volume. The majority of them are in /var/db/diagnostics/, while additional and lengthier log data is stored in files named by UUID in /var/db/uuidtext/.</p>
<p><span class="alignnone"><img alt="logcat01" class="alignnone size-full wp-image-46070" src="https://eclecticlight.co/wp-content/uploads/2019/10/logcat01.jpg?w=940" /></span></p>
<p>Those in /var/db/diagnostics/ are grouped into standard folders:</p>
<ul>
<li><strong>Persist</strong> holds tracev3 files that contain regular entries, the most important;</li>
<li><strong>Special</strong> has similar files for shorter-life entries;</li>
<li><strong>timesync</strong> contains files that enable the entries in tracev3 files to be matched with clock time;</li>
<li><strong>Signpost</strong> holds tracev3 files for special entries for measuring performance;</li>
<li><strong>HighVolume</strong> is normally empty, but might contain entries during periods when they’re particularly frequent.</li>
</ul>
<p>Unlike traditional Unix l

Inside the Unified Log 8: Find the error

https://fed.brid.gy/r/https://eclecticlight.co/2025/11/26/inside-the-unified-log-8-find-the-error/

<p>One of the most common reasons for looking in the log is when an error occurs and isn’t reported sufficiently. It’s also probably the most common reason for frustration with the log, when you can’t identify the error you were looking for. This article explains why the log may not be a good place to identify the cause of errors.</p>
<h4>Claude conned</h4>
<p>Perhaps the best illustration of the difficulties faced by those using the log to investigate errors is in Claude’s <a href="https://eclecticlight.co/2025/11/07/inside-the-unified-log-7-claude-diagnoses-the-log/">attempt to diagnose problems</a> with the Clock app.</p>
<p>First, it came across what it classed as a memory allocation error in the entry<br />
<code>00.968273 error com.apple.runningboard [app[application.com.apple.clock.1152921500311884024.1152921500311884029(501)]:1921] Memorystatus failed with unexpected error: Invalid argument (22)</code></p>
<p>Then it found and misinterpreted a cryptic entry from the kernel that also referred to memory<br />
<code>10.891949 kernel Clock[19237] triggered unnest of range 0x1e8000000->0x1ea000000 of DYLD shared region in VM map 0x5c946da0d472dbbf. While not abnormal for debuggers, this increases system memory footprint until the target exits.</code></p>
<p>It continued by misreading perfectly normal sequences of entries made by RunningBoard and FrontBoard, involving jargon such as <em>assertion,</em> as pathological cycles. Like someone who had

Inside the Unified Log 7: Claude diagnoses the log

https://fed.brid.gy/r/https://eclecticlight.co/2025/11/07/inside-the-unified-log-7-claude-diagnoses-the-log/

<p>Diagnosing problems using the Unified log is a complicated business that requires understanding, insight, experience and a systematic approach. As few of us feel competent to wade through thousands of log entries trying to spot where things go wrong, this might seem an ideal opportunity for the use of AI. I’m very grateful to one of our regular readers for the opportunity to demonstrate how Claude coped with diagnosing a troublesome problem they’ve been having with the Clock app in Tahoe.</p>
<h4>Signs and symptoms</h4>
<p>When you’re diagnosing any problem, you should start with a clear account of its signs and symptoms before even thinking of resorting to the log. A good physician may take an hour or more obtaining a full history and examining a patient before they start thinking about performing any special investigations. Even though signs and symptoms may not lead you to a diagnosis, they should help you direct your investigations to best effect.</p>
<p>In this case, although the Clock app is launching, when displaying some views the content is missing. We therefore agreed to capture the log from the moment of launch from the Finder until one of the problematic views displayed. That’s easy to achieve by double-clicking the app when the menu bar clock has just turned to display 00 seconds, then checking the time again when the view has been displayed. Add a couple of seconds to the latter to determine the period to view in LogUI.</p>
<h4>What&#8

Inside the Unified Log 4: Log entries

https://web.brid.gy/r/https://eclecticlight.co/2025/10/06/inside-the-unified-log-4-log-entries/

<p>For many years, I believed what the <code>log</code> command told me, that log entries could contain any of the 26 or more fields available, although they didn’t. It was only as I was developing utilities like LogUI that I discovered that log entries come in (at least) four types, each with its own format and set of fields. This article is a guide to those, and how they are displayed in LogUI.</p>
<h4>Entry fields</h4>
<p>Those available in the OSLog API are fewer in number than appear in <code>log</code> command output, and include some of limited interest. Those not exposed in LogUI include:</p>
<ul>
<li><em>store category,</em> which is invariably disk storage here.</li>
<li><em>format string,</em> that used to format the contents of messages. This was introduced following serious security leaks in High Sierra.</li>
<li><em>components,</em> linking in with the format string.</li>
</ul>
<p>LogUI displays each entry using the same order of fields and colour-coding. Although they can’t all be seen together in any single log entry, the overall sequence is:</p>
<p><span class="alignnone"><a href="https://eclecticlight.co/wp-content/uploads/2025/10/logs0.png"><img alt="" class="alignnone size-full wp-image-88727" height="51" src="https://eclecticlight.co/wp-content/uploads/2025/10/logs0.png" width="940" /></a></span></p>
<p>Standard levels are given as text, and chosen from one of the following: <em>fault, error, notice, info, debug, undefined.</em> These are only

Inside the Unified Log 3: Log storage and attrition

https://web.brid.gy/r/https://eclecticlight.co/2025/09/29/inside-the-unified-log-3-log-storage-and-attrition/

<p>By far the most common problem experienced with the Unified log isn’t its large number of entries, but a lack of entries. You go to check your Mac’s security using SilentKnight, or Skint runs its automatic daily check, and they can’t find any log entries recording XProtect Remediator scans. Since those are obtained by analysing the log for the previous 36 hours, when your Mac’s logs only go back 8-12 hours, entries for the last set of scans are likely to be missing. This article looks at why that happens, and how macOS maintains its log.</p>
<p>Traditional Unix-style logs are maintained according to their age. Every 24 hours, routine housekeeping procedures delete log files over a certain age, typically five days, in the process of rolling the log. Because the Unified log could over that five-day period have swallowed many GB of storage, its maintenance service <code>logd</code> deletes log records according to multiple criteria including the space they occupy, their age, and the type of entry. This is considerably more complex, and occurs in three phases, according to where the entry is stored.</p>
<h4>Ephemeral entries</h4>
<p>Log entries are initially written to memory, before <code>logd</code> writes most of them to permanent storage on disk.</p>
<p><span class="alignnone"><img alt="mul102LogdFlow" class="alignnone size-full wp-image-32537" src="https://eclecticlight.co/wp-content/uploads/2018/03/mul102logdflow.png?w=940" /></span></p>
<p>The fi

Inside the Unified Log 2: Why browse the log?

https://web.brid.gy/r/https://eclecticlight.co/2025/09/25/inside-the-unified-log-2-why-browse-the-log/

<p>Following the introduction of the Unified Log, a surprising number of folk you would expect to use it have stopped. Some experienced developers and those providing advice in Apple Support Communities seemingly take pride in their lack of log literacy, claiming that the log is now impossible to use, and only accessible to Apple’s engineers. While it does present obstacles, pretending that the log isn’t a vital tool in diagnosis and understanding is burying your head in the sand. This article shows why.</p>
<h4>Why the log?</h4>
<p>The log provides support for several purposes. It’s widely used to investigate events such as bugs and unexpected behaviours, to establish their cause before working out how to fix them, in diagnosis and troubleshooting. It’s also used to discover how subsystems within macOS work, and what they do. Examples of those include LaunchServices, DAS-CTS scheduling and dispatching, and RunningBoard, all of which are nearly invisible to other methods, but write copious and explicit entries in the log. With its precise time recording and special Signpost log entries, it’s also invaluable for measuring performance, hence in optimising code.</p>
<p>Concentrating on the log’s use in diagnosis, log entries can be used to answer most of the key questions:</p>
<ul>
<li>What happened?</li>
<li>When did it happen?</li>
<li>Who made it happen?</li>
<li>How did it happen?</li>
<li>Why did it happen?</li>
<li>What can I do about it

Client Info

Server: https://mastodon.social

Version: 2025.07

Repository: https://github.com/cyevgeniy/lmst