Retain Console System.log Events file for Usage Analysis

I recently became interested in tracking the usage of some Apple computers. I discovered that the system.log events file in Console provides the login and logout times. So, I was able to use that to calculate how much time the computers are being used. This was very handy because there was data from October 2010 to June 2011. I went back a few days later and discovered the log files had been purged all except a few weeks of data. Is there any way to prevent them from being purged? Or, can I increase the size of the retained system.log file? What's the point of a log file tracking events if it's only going to be deleted? Alternatively there are programs designed to keep track of computer usage such as login and logout times as well as user usage by application. Would you recommend one of these?

Thanks for bringing the typo to my attention. I've corrected that now. I'm reminded of the phenomenon by which we see and read words as groups of letters regardless of their positioning.
I've not really had any specific system problems that cause huge log files. However, sometimes when diagnosing problems it's nice to have a long period of time to examine possible issues.
Regarding your #3, opening .bz2 files... Have you saved these log files from Console and then tried opening them? It's just bazaar. The file opens to another file, then opens to another file, and so on. You never see the actual file contents. Others have observed the same thing.
Regarding your #4, I created the script you mention. It's described here:
http://www.resourcesforlife.com/docs/item4103
However, I'd like to just go ahead and use the existing system.log events.
Greg

Similar Messages

  • Without result recording closing system should not allow for usage decesion

    Hi
    without result recording closing system should not allow for usage decision.I think it is possible through user status. Please tell the procedure .
    Thanks and regards,
    vairavan

    Dear vairavan,
    You can check for the authorisation object.I can't remember that authoriation object right now.But surely you can restrict that with authorisation object.
    Anyone knows the authoristaion object.
    Regards,
    Sunil Patil

  • Hp Pavilion Sleekbook insydeh20 bios system log events

    Hello, after few failure messages, now the laptop boot correcly, entering in BIOS and choice system log I see a list of events stored in a list, is there any utility or options for delete all the events (system diagnostic failure results)?
    The same for HP Diagnostic Tool UEFI Results, any option for cancel all events?
    Thank you
    Max

    Hello @shenseera ,
    Welcome to the HP Forums!
    I understand you're unable to make calls on your notebook because the mic is not working.
    What software are you using to make the calls? Does it say no mic detected or is it that people cannot hear you?
    Please test your mic by following this video:
    I would also suggest going through this guide to troubleshoot microphone issues in Windows 8: Resolving Microphone and Line-in Problems (Windows 8).
    Let me know if that works.
    Please click the "Kudos, Thumbs Up" at the bottom of this post if you want to say "Thanks" for helping!
    Please click "Accept as Solution" if you feel my post solved your issue, it will help others find the solution.
    The Great Deku Tree
    I work on behalf of HP.

  • Importing Script file for speech analysis - error message

    I'd love to get some assistance to get past an error message in Premiere Pro CC, "Matching scene number not found".  However, I've named the scene number and the clip to match, simply as "1".  What am I missing?  NOTE:  the scene is 33 pages long as this is a long speech that I've transcribed and would like to match up to the video clip . . . just in case that is an issue that someone has experienced in the past.  But I'm hoping length of clip isn't a problem (as this is a typical work flow scenario for me).

    Hi,
    Even I am getting the same error while importing the .zip file for the second time through B2B console-->Administration-->Import/export tab.
    But again it works for the third time..
    Error Message:
    Import of file OriginalProject.zip failed. MDS-00521: error while reading document /soa/b2b/tpa_MnjhBHh-70301432125893445241.xml from metadata repository MDS-00520: failure to read document /soa/b2b/tpa_MnjhBHh-70301432125893445241.xml because it is not in the metadata repository MDS-00911: Document with name "/soa/b2b/tpa_MnjhBHh-70301432125893445241.xml" and version 34 does not exist in the repository. ORA-01403: no data found ORA-06512: at "DEV_MDS.MDS_INTERNAL_SHREDDED", line 407 ORA-06512: at "DEV_MDS.MDS_INTERNAL_SHREDDED", line 603 ORA-06512: at line 1 ORA-01403: no data found ORA-06512: at "DEV_MDS.MDS_INTERNAL_SHREDDED", line 407 ORA-06512: at "DEV_MDS.MDS_INTERNAL_SHREDDED", line 603 ORA-06512: at line 1 ORA-01403: no data found ORA-06512: at "DEV_MDS.MDS_INTERNAL_SHREDDED", line 407 ORA-06512: at "DEV_MDS.MDS_INTERNAL_SHREDDED", line 603 ORA-06512: at line 1
    Please help...

  • System Log Event ID 4321 every 30 seconds, system name conflict for a name not in use

    -- Symptom --
    System event log shows an error with event ID 4321 every 30 seconds:
    The name "pac-1          :2d" could not be registered on the interface with IP address 172.20.51.206. The computer with the IP address 172.20.21.2 did not allow the name to be claimed by this computer.
    -- Environment --
    OS:  Windows 7 x64 Enterprise
    Network:  Enterprise domain
    DHCP:  Yes
    WINS:  via DHCP
    -- Additional information --
    This computer was set up from an image.  The image was built with the system being named 'pac-1'.  This system's name was changed to 'pac-11' before (or possibly shortly after) joining the domain and now has a completely different name, and there
    is no system on the network with the name 'pac-1' (there are 'pac-3', and other numbers, but no 'pac-1')
    I have renamed the system with no change to the frequency of the error, and I cannot find 'pac-1' in the registry anywhere except for strings located in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LANDesk\Inventory\LogonHistory\Logons that list prior logons.
    I've done my google research and have found great information for plenty of other people's situations, just not this one.  Any helpful advice is welcome.
    Thank you!

    c0lorless wrote:
    -- Symptom --
    System event log shows an error with event ID 4321 every 30 seconds:
    The name "pac-1          :2d" could not be registered on the
    interface with IP address 172.20.51.206. The computer with the IP
    address 172.20.21.2 did not allow the name to be claimed by this
    computer.
    -- Environment -- OS:  Windows 7 x64 Enterprise
    Network:  Enterprise domain
    DHCP:  Yes
    WINS:  via DHCP
    -- Additional information -- This computer was set up from an image.  The image was built with the
    system being named 'pac-1'.  This system's name was changed to
    'pac-11' before (or possibly shortly after) joining the domain and
    now has a completely different name, and there is no system on the
    network with the name 'pac-1' (there are 'pac-3', and other numbers,
    but no 'pac-1')
    I have renamed the system with no change to the frequency of the
    error, and I cannot find 'pac-1' in the registry anywhere except for
    strings located in
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LANDesk\Inventory\LogonHistory
    \Logons that list prior logons.
    I've done my google research and have found great information for
    plenty of other people's situations, just not this one.  Any helpful
    advice is welcome.
    Thank you!
    I'd check my WINS server's registration entries, if they contain an
    entry with that NETBIOS name. If the machine with the ip-address
    172.20.21.2 is not your WINS server you need to check, what services
    etc. are running on that machine. Also look if the domain/workgroup
    name, which is used by this machine is correct and identical to all
    other machines.
    Wolfgang

  • Archive Windows System logs (event viewer)

    Hi Guys,
    Good Day.
    I want to export daily all System event logs and generate report to a .CSV or .TXT file and then copy the report file to,
    the following location \\Archivenasprd01\Appspr01\ddmmyyyy:
    or is it possible to schedule this job ever 1 or half on hour and copy all the system event logs to the same above location with create valid time-stamp
    Any help would be appreciated. Thanks.

    Hi,
    >>or is it possible to schedule this job ever 1 or half on hour and copy all the system event logs to the same above location with create valid time-stamp
    Based on your description, we can utilize a script and schedule a task to run the script to save the System event logs.
    For the script, in order to get better help, we can ask for suggestions in the following two forums.
    The Official Scripting Guys Forum
    http://social.technet.microsoft.com/Forums/scriptcenter/en-us/home?forum=ITCG
    Windows PowerShell
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverpowershell
    Besides, the following blog can be referred to as reference.
    Script to Save Event Logs
    http://blogs.msdn.com/b/jjameson/archive/2011/03/04/script-to-save-event-logs.aspx
    Best regards,
    Frank Shen

  • Is there a permissions system in Cloud Files for sharing with peers?

    My organization is interested in migrating to Creative Cloud, and a large part of that would be to replace the generic online file storage system that we currently use to store assets and graphics files.  I understand that files belong to individuals, however my question is about sharing with a limited set of individuals...
    For instance, if an employee uploads some assets received from a client, and these assets are needed by a team, but due to IP contracts it's important they aren't accessible to anyone else, is this possible using Cloud Files? 
    In addition, say a group of employees is working on a Photoshop file, and one person needs to make a change that everyone else needs before they may continue working on it.  Is it possible for one employee to lock the file so nobody else can modify it until the lock is released?
    Thanks, I look forward to your answers!

    This will be possible once improved sharing and collaboration are released. This will be soon by is not yet available. You will see several threads in the forums of customers requesting folder sharing. Folder sharing will be one part of it, but also there will be private sharing with specific individuals.
    Currently you can only share individual files and the shared url is public.

  • Safari continuously posts to the console system log

    CFPropertyListCreateFromXMLData(): Old-style plist parser: missing semicolon in dictionary
    I am using Mac OS X 10.7.5 with Safari 6.1.1 I have updated everything and repaired permissions and repaired the drive.
    I have turned off all extensions.
    I continue to get this error message.
    Anyone have any ideas?
    Thanks and Happy New Year

    The console log entry is probably not related to the connection problem you're having. That is more likely related to a software process running on your computer, like fax software or the printer queue or something else that keeps looking for a fax device.
    What kind of Internet connection are you using (ADSL, cable, dial-up modem, etc.)? It would be helpful to know that.

  • I am trying to understand my Console System Log Queries, but not having much luck!!

    I am trying to understand my MB late 2011, much better than I do, whilst looking through my console messages, I realised I don't have a clue as too whats what, I seem to be getting a lot of system errors - Is this normal?
    Why are Mac Books soooo complicated - !
    I would copy and paste my system messages - but once again I am 2 thick -  don't know which bits - if any  would need editing!
    Any advise would be a great help.
    Thankyou  in advance.
    la9

    You would use the Input button on your remote to set the Input to RGB PC and you'll also need audio cables to the TV because the Mini-DVI does not carry audio using a 3.5mm stereo headphone jack to RCA sound plug. You attach it from the headphone jack of your MacBook to the appropriate input plug on your TV.
    When you first hook it up it will probably have the display set in Extended Desktop mode. The Menu Bar and Dock will be on the MacBook display and your background screen on the TV but you can move the cursor onto the TV screen.
    In System Preferences>Display on the MacBook screen there should be an Arrangement tab when you have the MacBook hooked up to the TV and both screens working. When you click the Arrangement tab do you see two monitors side by side? One of them will have a Menu Bar at the top. Just click on the Menu Bar and drag it to the second monitor. That will make the second monitor your main screen. You can now use your MacBook in Clamshell Mode with a wired or Bluetooth keyboard and mouse.  http://support.apple.com/kb/HT3131 When you disconnect from the TV your Menu Bar will automatically change back to the MacBook.
    Or if you want to work on the MacBook screen while showing it on a TV you can check the Mirror Display box on the lower left hand side of the Arrangement tab under the two monitors box.

  • "cor" file for problem analysis

    Hello,
    I have 2 "sections" in "diagnosis files" that appeared after a database check, one on 29th 01 and the other yesterday.
    What can i do with these files ?
    ****For the "first" core file, i have done 2 checks :
    First :
    2009-01-29 18:02:18 10874 ERR 51080 SYSERROR -9005 BD Illegal key
    2009-01-29 18:03:10 10874 ERR 53000 B*TREE   07010000000000019823000000000000
    2009-01-29 18:03:10 10874 ERR 53000 B*TREE   Index Root  480166
    2009-01-29 18:03:10 10874 ERR 53348 B*TREE   bd402SearchIndexForQuali: 481217
    2009-01-29 18:03:10 10874 ERR 53250 INDEX    Bad Index 480166 (Root)
    2009-01-29 18:03:10 10874 ERR 53250 INDEX    Reason "System error: BD Invalid invli"
    2009-01-29 18:03:11 10874 ERR 51080 SYSERROR -9041 BD Index not accessible
    2009-01-29 18:04:28 10876 ERR 53019 CHECK    Base error: index_not_accessib
    2009-01-29 18:04:28 10876 ERR 53019 CHECK    Root pageNo: 480166
    2009-01-29 18:04:30 10876 ERR 53000 CHECK    Check data finished unsuccessfully
    2009-01-29 18:14:58 10873 ERR 53019 CHECK    Base error: index_not_accessib
    2009-01-29 18:14:58 10873 ERR 53019 CHECK    Root pageNo: 480166
    2009-01-29 18:14:59 10873 ERR 53000 CHECK    Check data finished unsuccessfully
    Second :
    2009-01-29 18:17:21  9746 ERR 53000 CHECK    Check data finished unsuccessfully
    2009-01-29 18:29:31  9744 ERR 53000 B*TREE   07010000000000019823000000000000
    2009-01-29 18:29:31  9744 ERR 53000 B*TREE   Index Root  480166
    2009-01-29 18:29:31  9744 ERR 53367 B*TREE   bd400_DeleteSubTrees: 481217
    For the "Second" core file, i have done 1 check :
    2009-02-05 21:07:10  4672 ERR 53370 B*TREE   Illegal record length: 7823
    2009-02-05 21:07:10  4672 ERR 53370 B*TREE   Corrupted data page: 206842
    2009-02-05 21:07:10  4672 ERR 53000 B*TREE   0701000000000001CBDE000000000000
    2009-02-05 21:07:10  4672 ERR 53000 B*TREE   Index Root  662212
    2009-02-05 21:07:10  4672 ERR 53250 INDEX    Bad Index 662212 (Root)
    2009-02-05 21:07:10  4672 ERR 53250 INDEX    Reason "System error: BD Illegal entry"
    2009-02-05 21:07:10  4671 ERR 53019 CHECK    Base error: index_not_accessib
    2009-02-05 21:07:10  4671 ERR 53019 CHECK    Root pageNo: 662212
    2009-02-05 21:20:02  4671 ERR 53000 CHECK    Check data finished unsuccessfully
    I guess a disk problem. The disks subsystem is in raid 10 (6 disks, 3 stripped  * 2 disks mirrored).
    I haven't to now installed specific software to read states about the sas card and the disks, but
    i will seach.
    I big question : when a "corrupted date  page" arrived, how do maxDB handle these problem ?
    Does le data in the page be lost after repair ?

    > I have 2 "sections" in "diagnosis files" that appeared after a database check, one on 29th 01 and the other yesterday.
    >
    > What can i do with these files ?
    Since you've to ask the answer is: nothing.
    Developers can use the COR files (these are the dumped corrupt pages) and check, why they were found corrupt.
    > I big question : when a "corrupted date  page" arrived, how do maxDB handle these problem ?
    > Does le data in the page be lost after repair ?
    MaxDB does not handle corruptions different than any other DBMS for SAP.
    It reports that there is something wrong and gives up trying to read the data.
    (Unfortunately MaxDB has yet to learn that not all corruptions are a reason to crash - but that's a different topic...).
    Corrupted data can never be repaired - by no DBMS available. It may be possible to recreate the data (e.g. Index rebuild, reloading of BW data etc.) but the database software cannot know what was supposed to be in the damaged data page.
    That's one of the reasons, why taking and checking database backups is crucial.
    Anyhow, if you are a SAP customer, don't miss to open a support call for this.
    regards,
    Lars

  • SAP NetWeaver System Logging (SM21) - ABAP Test and Analysis Tools - SAP Library

    To add a comment, please log in or register on the top of this page and choose Reply. Please write your comment in English.
    You can also go back to the SAP help page.

    Hi Vikas,
    thank you very much for your quick answer.
    Am I getting it right that you installed the Web Application Server and the XI on the same machine? I read about the mandatory installation on two seperate machines but I hope that the installation on one machine is also possible when using the server for testing purposes.
    What processor do you have? Do you think my Pentium 4 2.8 GHz processor will do it?
    Very appreciative greetings,
    Florian

  • System config files for Labview App

    In Win 7, I am building a Labview project.  Where should I store the user selected system specific configuration files for the app operation?  Things like data directories, log file directories, etc

    If you mean your own build application
    WHat I do in my projects is the following :
    - LabVIEWs ini file in the same folder as exe
    - Log files in directory logfiles next to exe
    - other data files like settings, configuration etc in a datafolder next to the exe
    If you mean with your source code
    - create folders for every type of VI : globals, controls(typedef), subVI, FGLB, ...
    - create a datafolder for your datafiles your using
    - create logfolder for your logfiles
    Kind regards,
    - Bjorn -
    Have fun using LabVIEW... and if you like my answer, please pay me back in Kudo's
    LabVIEW 5.1 - LabVIEW 2012

  • Console message and system.log

    Hi,
    in the console system.log always apear this message every 30 second:
    +Feb 16 02:22:55 Macintosh SystemUIServer[346]: Error: ACInterfaceGetPower() called with invalid interface+
    +Feb 16 02:23:25: --- last message repeated 5 times ---+
    and every 5 second this other message:
    16/02/08 02:40:55 SystemUIServer[346] Error: ACInterfaceGetPower() called with invalid interface
    .. and the message look like an infinite loop message.
    Is it a problem ?
    And i can ear the Internal HD run always.
    Thanks on advice for any help
    Ale

    I just went through a bunch of research on this on my own iMac G5. (BTW - do you have an iMac G5 or an iMac Intel Core Duo? It can't be both)
    It comes down to the items that the SystemUIServer is trying to call. if you look at <homefolder>/Library/Preferences/com.apple.systemuiserver.plist and open it with TextEdit, you'll see that, among other things, it references 8 menuExtras -
    Battery.menu
    Displays.menu
    TimeMachine.menu
    Bluetooth.menu
    AirPort.menu
    Volume.menu
    Clock.menu
    User.menu
    While logged in as an administrative user, I launched System Preferences, Activity Monitor, and the Console looking at *+All Messages+*. I got the same ACInterfaceGetPower() error every 5 seconds, too. So I went through the Preferences and deactivated each menu item above, but the messages continued to appear.
    I had two items that might have been causing a problem. The first was the fact that I had the AirPort signal showing up in the menu bar, even though the Network location I have set up does not have AirPort as an available service. I added the Airport service back in, disabled the menu icon, removed the AirPort service again, and Applied the changes. I'm pretty sure the error message was still appearing at this point.
    The big change came when I opened up Accounts. First, I went to the Login Items section for my current user. I noticed that the EyeTV Helper and an Adobe process were both there along with the iTunes Helper process. I removed the first two using the "-" at the bottom. That actually appeared to fix it, but I proceeded to the Login Options section and disabled *Fast User Switching*. That removes the users from the menu bar. By this time the only thing left in the menu bar was the Spotlight icon.
    Switching over to Activity Monitor, I killed the SystemUIServer process. It restarted and the ACInterfaceGetPower() messages did not reappear. I then re-activated each item, one at a time, killing the SystemUiServer after each activation. Again, the messages did not appear. I did not re-activate Bluetooth or AirPort, since I do not need them.
    I am no longer getting those messages and the system appears to be running fine right now.
    I have an external monitor attached to the iMac G5 as well as 4 FireWire hard drives. I am connected to the outside world via FiOS and I have a 100 Mb CAT-5 connection to that router.

  • SystemFlippers ?  in system log

    I was receiving a message in my system.log -
    unknown SIGSEGV code O
    so.... I followed the techNote
    http://kb2.adobe.com/cps/408/kb408562.html
    and used the licensing fix too.
    it fixed it but left me with a new console>system.log entry when I start Illustrator ( CS4, Mac 10.5.7 intel)
    Jul 29 09:56:09 G5 [0x0-0x175175].com.adobe.illustrator[9016]: SystemFlippers: didn't consume all data for DLOG ID 10033 (pBase = 0x5955a00, p = 0x5955a20, pEnd = 0x5955cc6)
    ( don't be confused with the G5 listed in the error, it's just name of this computer on the network, but it is a MacPro intel)
    what is it and what to do?
    thx.

    Hello
    Please implement the latest kernel for your release. See note #19466. The error will not occur with the latest kernel patch.
    Regards
    Mark

  • Critical Logging Event  Red ( /sapapo/om13)

    Hello,
    In  /sapapo/om13--->checks, we can see critical logging event is red.
    I logging section, message are
    1> error in /SAPAPO/OM_REORG_DAILY (date 16.10.2007)
    2> Planning version was created.(date 13.10.2007)
    3> ATP time series active(date 12.10.2007)
    4> error OM13 ( date 10.10.2007)
    we want to turn this critical loging event to green.
    Should we delete livecache application logs via /sapapo/om12  or is there any other way to turn it into green.
    As far as I know, /sapapo/OM13->Logging contains last entries from logging log.(/sapapo/om13->Logging----
    >Logging Log .)But Last entries means how many? any parameter to do this?(Just a query)
    Can somebody please help me turning critical event log to green.
    Please feel free to add  thougts.Thanks.
    Regards,
    Tushar
    Message was edited by:
            Tushar Chavan

    Hello Tushar,
    You could turn critical event log to green if you will not have the Critical Logging Events for the last 5 days.
    For example, OM13 could Shows the Critical Logging Event as Yellow. You could run the transaction /sapapo/om11 or /sapapo/OM13 -> tab 'logging' to review the critical logging events, which have occurred recently on your system. If , for example, the 'Old transactional simulations deleted' by the //om_ reorg_daily report or corrections of the inconsistencies in /sapapo/om17 were done on your system, the events will be listed in the 'logging' section. And the OM13 Shows Critical Logging Event (Yellow) to pay attention for you to check 'logging' for more details.                                                                               
    Information to the reason of the yellow light can be found via the blue info button.                                                                     
    For example on the my local system in the transaction /sapapo/om13 -Checks -> 'Critical Logging Event' shows the yellow light. Before the yellow light you will see the last Event to be checked in "Logging".             
    The next info was displayed, when I was clicked blue info button:                
    At least one critical logging event has occurred recently. See "Logging"         
    in the Writer for more details.                                                  
    And when will go to the  transaction /sapapo/om13 -> logging ( or you could use the transaction /sapapo/om11 ), you will see  "Logging" list of events for more details.    
    -> In your case if you have red light for the Critical Logging Event, you need to correct the problem with the error in  "Logging"  event.
    -> You should not delete the "Logging"  events on your system to get the green light
    in //om13->checks, "Logging"  events needed for the further analysis of the LCA problems on your system, if you have them or will have in future.
    -> If the error in /SAPAPO/OM_REORG_DAILY occurred, it has to be checked/corrected. And if the job will run without errors the problem is gone. See the SAP note 800927.
    ->"2> Planning version was created.(date 13.10.2007)
          3> ATP time series active(date 12.10.2007)"
        Please review the SAP note: 792286 Repairing/activating ATP time series.
        Are you running the system upgrade?
    < If yes, then the note 792286 is NOT needed to be applied or pay attention.
    During the upgrade the step to activate the ATP time series is before to load the master data to liveCache in the target release. And during the load master data the planning versions were loaded < created > to the liveCache from APO database. >
        What is the version of your system?
    -> I recommend you to create the OSS message to the component 'BC-DB-LCA'
        to check the critical LCA events on your system.
    Thank you and best regards, Natalia Khlopina

Maybe you are looking for