Glam Prestige Journal

Bright entertainment trends with youth appeal.

In previous version of OSX, I was able to view the results of past Time Machine backup jobs thus:

sudo syslog -F '$Time $Message' -k Sender com.apple.backupd

Now syslog is no longer part of the operating system. It has been replaced by "log."

I have failed to find info about time machine jobs using "log." I have also failed using (the new version of) console.

Any suggestions?

7 Answers

macOS Sierra uses Unified Logging (memory and a data store; no text files any longer).

However, with the log(1) utility, you can view, filter, manipulate etc. logs. See man log, and here's a couple of TimeMachine-specific examples:

Stream the log, live (like tail):

log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

Don't stream, just show the log and exit:

log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

3

I had a similar problem. I wrote this shell script to show me the last 12 hours of Time Machine activity from the log, and then continue to follow the log live.

I call it tm-log

#!/bin/sh
filter='processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'
# show the last 12 hours
start="$(date -j -v-12H +'%Y-%m-%d %H:%M:%S')"
echo ""
echo "[History (from $start)]"
echo ""
log show --style syslog --info --start "$start" --predicate "$filter"
echo ""
echo "[Following]"
echo ""
log stream --style syslog --info --predicate "$filter"
1

For those looking for a live view of Time Machine messages in the GUI Console app, enable "Include Info Messages" in the Action menu.

The useful Time Machine status messages will then show up and can be filtered with a search like Category:TMLogInfo.

It looks like log(1) is needed to view the history since Console doesn't show anything from before it was opened.

1

Here's improved version of @JimRandell tm-log script:

#!/usr/bin/env bash
LAST=${1:-3h}
ARGS=( --style default --info --predicate 'processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"' )
log() { /usr/bin/log "$@" "${ARGS[@]}" | tr -s ' ' | sed 's/com.apple.TimeMachine://g' | cut -d' ' -f 1,2,10-
}
log show --last $LAST
log stream

By default it shows Time Machine log for the last three hours and then waits for log messages. You can change default time period for last messages:

$ tm-log 12h

Currently, my solution is to use log stream --style syslog --predicate 'subsystem == "com.apple.TimeMachine"' --info. But I am not quite happy with it, so I am still searching for a better way.

Copy & Paste the Following exactly as shown below

log show --predicate 'subsystem == "com.apple.TimeMachine"' --info | grep 'upd: (' | cut -c 1-19,140-999

In "terminal" type (or copy from here and paste):

log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

This works, but as this is streaming, it displays the activity as it happens. If there's no time-machine activity - it will not display much (or anything). Initially is may dump stuff that's a few days old that may be cached somewhere, but then it displays the log in pretty much real-time.

I have used this stream of the log to identify a specific corrupt file on my disc that was preventing completion of backups. Removed the file (actually a whole folder) and woilla - backup completed on first run. No more errors.

Related Journals