How to view time machine log in MacOS Sierra?

In previous version of OSX, I was able to view the results of past Time Machine backup jobs thus:

sudo syslog -F '$Time $Message' -k Sender com.apple.backupd

Now syslog is no longer part of the operating system. It has been replaced by "log."

I have failed to find info about time machine jobs using "log." I have also failed using (the new version of) console.

Any suggestions?

Arnstein

Posted 2016-09-22T05:43:39.750

Reputation: 451

Answers

macOS Sierra uses Unified Logging (memory and a data store; no text files any longer).

However, with the log(1) utility, you can view, filter, manipulate etc. logs. See man log, and here's a couple of TimeMachine-specific examples:

Stream the log, live (like tail):

log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

Don't stream, just show the log and exit:

log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

Chipster

Posted 2016-09-22T05:43:39.750

Reputation: 681

Hello Chipster, thanks for the reply. Unfortunately your suggestion did not work. I applied the second of your commands (Don't stream) and all I got was this: 2016-09-22 10:25:17.242554-0700 localhost eventsd[4378]: (TimeMachine) TimeMachineMonitor Running This, after doing two time machine backups. – Arnstein – 2016-09-23T03:16:14.877

Hello again Chipster,

Your second command (Don't stream) is working for me now. However this command only returns info about the last Time Machine backup that I performed. I speculate that after every reboot, all logging info is lost. Do you think this is true? Is there a way to query for older info? – Arnstein – 2016-09-23T17:05:41.147

Arnstein, I'm new to this too, but it is my understanding that log messages of level "Info" only are kept in memory by default and will therefore not survive a reboot. If you want TimeMachine Info messages to be saved to disk, try doing: # log config --subsystem com.apple.TimeMachine --mode persist:info (as root). – Lennart L – 2016-09-23T22:49:29.777

I had a similar problem. I wrote this shell script to show me the last 12 hours of Time Machine activity from the log, and then continue to follow the log live.

I call it tm-log

#!/bin/sh

filter='processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'

# show the last 12 hours
start="$(date -j -v-12H +'%Y-%m-%d %H:%M:%S')"

echo ""
echo "[History (from $start)]"
echo ""

log show --style syslog --info --start "$start" --predicate "$filter"

echo ""
echo "[Following]"
echo ""

log stream --style syslog --info --predicate "$filter"

Jim Randell

Posted 2016-09-22T05:43:39.750

Reputation: 391

6log takes a --last parameter, which can be simpler than computing --start (e.g. --last 12h to show the last 12 hours) – Miles – 2017-08-06T00:02:32.507

For those looking for a live view of Time Machine messages in the GUI Console app, enable "Include Info Messages" in the Action menu.

The useful Time Machine status messages will then show up and can be filtered with a search like Category:TMLogInfo.

It looks like log(1) is needed to view the history since Console doesn't show anything from before it was opened.

gabedwrds

Posted 2016-09-22T05:43:39.750

Reputation: 230

Thanks for this! I also had to add Category:TMLogError to be able to see the error messages ;) – gsaslis – 2019-10-09T11:48:04.257

Currently, my solution is to use log stream --style syslog --predicate 'subsystem == "com.apple.TimeMachine"' --info. But I am not quite happy with it, so I am still searching for a better way.

Damien Clauzel

Posted 2016-09-22T05:43:39.750

Reputation: 235

Copy & Paste the Following exactly as shown below

log show --predicate 'subsystem == "com.apple.TimeMachine"' --info | grep 'upd: (' | cut -c 1-19,140-999

PJ Mele

Posted 2016-09-22T05:43:39.750

Reputation: 21

In "terminal" type (or copy from here and paste):

log stream --style syslog  --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

This works, but as this is streaming, it displays the activity as it happens. If there's no time-machine activity - it will not display much (or anything). Initially is may dump stuff that's a few days old that may be cached somewhere, but then it displays the log in pretty much real-time.

I have used this stream of the log to identify a specific corrupt file on my disc that was preventing completion of backups. Removed the file (actually a whole folder) and woilla - backup completed on first run. No more errors.

Shahar

Posted 2016-09-22T05:43:39.750

Reputation: 1