ZEKASTRA

macOSAdvancedSystem logs

Apple Unified Logging (tracev3)

macOS 10.12+ binary log store: tracev3 files in /var/db/diagnostics with strings in /var/db/uuidtext, read with log show or a parser.

01Location

  • /private/var/db/diagnostics/ (Persist/, Special/, Signpost/, HighVolume/, timesync/)
  • /private/var/db/diagnostics/logdata.statistics.*.txt, logd.*.log, shutdown.log, version.plist
  • /private/var/db/uuidtext/<XX>/<30 hex>
  • /private/var/db/uuidtext/dsc/<32 hex>
  • <name>.logarchive (bundle created by log collect)

02Questions it answers

  • What did a process, subsystem or daemon log at a given time?
  • When did logins, authentication prompts, device connections or software installations occur, as reported by the responsible subsystem?
  • Which boot session did an event belong to?

03Format and versions

FormatCompressed binary tracev3 chunk files. Format strings live in uuidtext and shared-cache (dsc) files; entries carry Mach continuous time that timesync files map to wall-clock time.
Applies toUnified logging is available in macOS 10.12 and later and supersedes ASL and syslog APIs (Apple).

04Key fields

FieldWhat it tells you
TimestampDisplayed by the log tool as YYYY-MM-DD HH:MM:SS.ssssss with time-zone offset.
Subsystem, categoryReverse-DNS subsystem and category strings chosen by the logging code.
Process / sender image path, PID, thread IDOriginating process and the library or binary that emitted the message.
Message typeDefault, Info, Debug, Error or Fault.
Activity IDGroups messages belonging to one activity.
Boot UUIDBoot identifier stored in tracev3 headers; separates boot sessions.

05Timestamps

FieldEncodingNote
Entry timeMach continuous time + timebase, mapped via timesync recordslibyal notes the time appears stored in UTC while the log tool shows the local time zone.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. On a live system, create an archive with log collect; from an image, copy both diagnostics and uuidtext with their directory structure.
  2. Read the archive with log show (add --info and --debug, which are hidden by default) or with a parser that resolves uuidtext and dsc strings.
  3. Filter with predicates on subsystem, process, senderImagePath or eventMessage, and bound the time range with --start and --end.
  4. Record the time zone used for display and convert to UTC for the timeline.

07Interpretation pitfalls

  • Debug messages are not persisted and Info only when collected with the log tool; Default, Error and Fault are kept up to a storage limit and then purged.
  • Dynamic strings and objects are redacted by default (<private>) unless the developer marked them public.
  • Without the matching uuidtext/dsc files, message text cannot be fully rebuilt.
  • log show on individual tracev3 files does not return entries in temporal order; a logarchive does.

09Sources

  1. Logging Apple Developer Documentation · checked 2026-10-14
  2. Generating Log Messages from Your Code Apple Developer Documentation · checked 2026-10-14
  3. Viewing Log Messages Apple Developer Documentation · checked 2026-10-14
  4. libyal dtformats — Apple Unified Logging and Activity Tracing formats Joachim Metz (GitHub) · checked 2026-10-14
  5. Logs Unite! Forensic Analysis of Apple Unified Logs Sarah Edwards (mac4n6, GitHub) · checked 2026-10-14
  6. ForensicArtifacts — artifacts/data/macos.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14