Apple has updated the OSX’s logging system in OSX 10.12. The
Console.app for viewing logs was also updated and has become pretty much useless. I couldn’t find TimeMachine logs anywhere, for example. It seems that past messages cannot be seen there at all. Luckily there is still a way to see the proper logs in the terminal. This superuser question has answers for how to do that, using the
log utility. However, when I tried it locally I only got:
That was very weird, because even
log show reported the same error. Something must be terribly wrong with the system.
After some time, I stumbled upon
man zshbuiltins and discovered that
log is a built-in command in
zsh — and that is why the previous commands didn’t work as expected. If you have the same issue, there are multiple ways to deal with it, a few of them are:
Use the full path:
/usr/bin/log show --style syslog --info --last 10m --predicate 'processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'.
Better, create an alias such as:
alias llog=/usr/bin/log, and use it:
llog show ….
PS. That behavior was taking place a couple of months ago. I tried the same commands today, and the
log show command just worked! Moreover, trying to force the built-in command fails:
I have not disabled it in any way, however
oh-my-zsh could have changed the behavior. I cannot find any
unset log, or anything similar in my zsh dotfiles, and yet if I run
zsh without any rc files,
log is the builtin there:
1 2 3
This is a mystery so far! Do you know what happens here?