System.log file

I need to find the system.log file, but cannot. Where is it?
Thanks for your help.
Cheers,
Jurgen

To see the log's contents, open the Console in the /Applications/Utilities/ folder and click on the Logs button; one of the entries will be the system.log.
To see the log itself, choose Go to Folder from the Finder's Go menu, enter /private/var/log/ as the folder's path, and locate the system.log file when that folder appears.
(10574)

Similar Messages

Total lock-ups with fan running - translate system.log file please!?

Hi, all. My late 2005 2.3 gig dual G5 has been experiencing random lock ups for as long as I can remember. My system is up to date and I have tested each pair of the 5 gigs of ram that I have and the system freezes with each pair. It can happen at any time, when I am doing absolutely nothing, for example, overnight. I am at my wits end!
Here's the system log file for the latest freezes. Can anyone tell me what's going on here??? I really need to get to the root of this problem. Thanks so so much in advance.
Apr 12 17:32:52 Marc-Weinbergs-Computer kernel[0]: AFP_VFS afpfs_Reconnect: connect on /Volumes/Macintosh HD failed 89.
Apr 12 17:32:52 Marc-Weinbergs-Computer kernel[0]: AFP_VFS afpfs_unmount: /Volumes/Macintosh HD, flags 524288, pid 62
Apr 12 17:44:46 Marc-Weinbergs-Computer /Library/Application Support/FLEXnet Publisher/Service/11.03.005/FNPLicensingService: Started\n
Apr 12 17:44:46 Marc-Weinbergs-Computer /Library/Application Support/FLEXnet Publisher/Service/11.03.005/FNPLicensingService: This service performs licensing functions on behalf of FLEXnet enabled products.\n
Apr 12 18:01:06 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
Apr 12 18:01:49 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
Apr 12 18:08:29 Marc-Weinbergs-Computer diskarbitrationd[69]: SDCopy [1056]:36091 not responding.
Apr 12 18:16:18 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
Apr 12 18:16:53 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
Apr 12 19:24:12 Marc-Weinbergs-Computer ntpd[191]: time reset -0.650307 s
Apr 13 01:05:45 Marc-Weinbergs-Computer ntpd[191]: time reset -0.496917 s
Apr 13 03:15:03 Marc-Weinbergs-Computer cp: error processing extended attributes: Operation not permitted
Apr 13 07:15:03 Marc-Weinbergs-Computer postfix/postqueue[1778]: warning: Mail system is down -- accessing queue directly
Apr 13 03:15:03 Marc-Weinbergs-Computer cp: error processing extended attributes: Operation not permitted
Apr 13 15:53:53 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
Apr 13 15:53:54 Marc-Weinbergs-Computer KernelEventAgent[62]: tid 00000000 received unknown event (256)
Apr 13 22:15:48 localhost kernel[0]: standard timeslicing quantum is 10000 us
Apr 13 22:15:47 localhost mDNSResponder-108.6 (Jul 19 2007 11: 33:32)[63]: starting
Apr 13 22:15:48 localhost kernel[0]: vmpagebootstrap: 506550 free pages
Apr 13 22:15:47 localhost memberd[70]: memberd starting up
Apr 13 22:15:49 localhost kernel[0]: migtable_maxdispl = 70
Apr 13 22:15:49 localhost kernel[0]: Added extension "com.firmtek.driver.FTATASil3132E" from archive.
Apr 13 22:15:49 localhost kernel[0]: Added extension "com.firmtek.driver.Sil3112DeviceNub" from archive.
Apr 13 22:15:49 localhost kernel[0]: Copyright (c) 1982, 1986, 1989, 1991, 1993
Apr 13 22:15:49 localhost kernel[0]: The Regents of the University of California. All rights reserved.
Apr 13 22:15:49 localhost kernel[0]: using 5242 buffer headers and 4096 cluster IO buffer headers
Apr 13 22:15:49 localhost kernel[0]: AppleKauaiATA shasta-ata features enabled
Apr 13 22:15:49 localhost kernel[0]: DART enabled
Apr 13 22:15:47 localhost DirectoryService[75]: Launched version 2.1 (v353.6)
Apr 13 22:15:49 localhost kernel[0]: FireWire (OHCI) Apple ID 52 built-in now active, GUID 001451ff fe1b4c7e; max speed s800.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:48 localhost lookupd[71]: lookupd (version 369.5) starting - Sun Apr 13 22:15:48 2008
Apr 13 22:15:49 localhost kernel[0]: USBF: 20.590 OHCI driver: OHCIRootHubPortPower bit not sticking (1). Retrying.
Apr 13 22:15:49 localhost kernel[0]: Extension "com.microsoft.driver.MicrosoftKeyboardUSB" has no kernel dependency.
Apr 13 22:15:49 localhost kernel[0]: AppleSMUparent::clientNotifyData nobody registed for 0x40
Apr 13 22:15:49 localhost kernel[0]: Security auditing service present
Apr 13 22:15:49 localhost kernel[0]: BSM auditing present
Apr 13 22:15:49 localhost kernel[0]: disabled
Apr 13 22:15:49 localhost kernel[0]: rooting via boot-uuid from /chosen: 82827EDF-0263-3B93-BEED-4B114E820B85
Apr 13 22:15:49 localhost kernel[0]: Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>
Apr 13 22:15:49 localhost kernel[0]: Got boot device = IOService:/MacRISC4PE/ht@0,f2000000/AppleMacRiscHT/pci@9/IOPCI2PCIBridge/k2-sat a-root@C/AppleK2SATARoot/k2-sata@0/AppleK2SATA/ATADeviceNub@0/IOATABlockStorageD river/IOATABlockStorageDevice/IOBlockStorageDriver/ST3320620AS Media/IOApplePartitionScheme/AppleHFS_Untitled1@10
Apr 13 22:15:49 localhost kernel[0]: BSD root: disk0s10, major 14, minor 12
Apr 13 22:15:49 localhost kernel[0]: jnl: replay_journal: from: 8451584 to: 11420160 (joffset 0x952000)
Apr 13 22:15:50 localhost kernel[0]: AppleSMU -- shutdown cause = 3
Apr 13 22:15:50 localhost kernel[0]: AppleSMU::PMU vers = 0x000d00a0, SPU vers = 0x67, SDB vers = 0x01,
Apr 13 22:15:50 localhost kernel[0]: HFS: Removed 8 orphaned unlinked files
Apr 13 22:15:50 localhost kernel[0]: Jettisoning kernel linker.
Apr 13 22:15:50 localhost kernel[0]: Resetting IOCatalogue.
Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
Apr 13 22:15:50 localhost kernel[0]: Matching service count = 1
Apr 13 22:15:50 localhost kernel[0]: Matching service count = 3
Apr 13 22:15:50 localhost kernel[0]: NVDANV40HAL loaded and registered.
Apr 13 22:15:50 localhost kernel[0]: PowerMac112ThermalProfile::start 1
Apr 13 22:15:50 localhost kernel[0]: PowerMac112ThermalProfile::end 1
Apr 13 22:15:50 localhost kernel[0]: SMUNeo2PlatformPlugin::initThermalProfile - entry
Apr 13 22:15:50 localhost kernel[0]: SMUNeo2PlatformPlugin::initThermalProfile - calling adjust
Apr 13 22:15:50 localhost kernel[0]: PowerMac112ThermalProfile::adjustThermalProfile start
Apr 13 22:15:50 localhost kernel[0]: IPv6 packet filtering initialized, default to accept, logging disabled
Apr 13 22:15:50 localhost kernel[0]: BCM5701Enet: Ethernet address 00:14:51:61:ee:78
Apr 13 22:15:50 localhost kernel[0]: BCM5701Enet: Ethernet address 00:14:51:61:ee:79
Apr 13 22:15:51 localhost lookupd[86]: lookupd (version 369.5) starting - Sun Apr 13 22:15:51 2008
Apr 13 22:15:51 localhost kernel[0]: jnl: replay_journal: from: 21611008 to: 7857152 (joffset 0x952000)
Apr 13 22:15:51 localhost kernel[0]: jnl: replay_journal: from: 673280 to: 24382976 (joffset 0x952000)
Apr 13 22:15:51 localhost kernel[0]: jnl: replay_journal: from: 3890176 to: 6294016 (joffset 0x7d01000)
Apr 13 22:15:51 localhost diskarbitrationd[69]: disk0s10 hfs 82827EDF-0263-3B93-BEED-4B114E820B85 NewestSeagate /
Apr 13 22:15:52 localhost kernel[0]: NVDA,Display-A: vram [90020000:10000000]
Apr 13 22:15:52 localhost mDNSResponder: Adding browse domain local.
Apr 13 22:15:53 localhost kernel[0]: hfs mount: enabling extended security on Maxtor
Apr 13 22:15:53 localhost diskarbitrationd[69]: disk1s3 hfs 0DBE2113-B1F5-388F-BF70-2E366A095330 Maxtor /Volumes/Maxtor
Apr 13 22:15:54 localhost kernel[0]: NVDA,Display-B: vram [94000000:08000000]
Apr 13 22:15:54 Marc-Weinbergs-Computer configd[67]: setting hostname to "Marc-Weinbergs-Computer.local"
Apr 13 22:15:54 Marc-Weinbergs-Computer /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow: Login Window Application Started
Apr 13 22:15:56 Marc-Weinbergs-Computer diskarbitrationd[69]: disk2s3 hfs 971CABB3-C211-38FC-8E91-6B4F8EA5FA20 B08-09-07 /Volumes/B08-09-07
Apr 13 22:15:56 Marc-Weinbergs-Computer loginwindow[110]: Login Window Started Security Agent
Apr 13 22:15:57 Marc-Weinbergs-Computer kernel[0]: AppleBCM5701Ethernet - en1 link active, 1000-Mbit, full duplex, symmetric flow control enabled
Apr 13 22:15:57 Marc-Weinbergs-Computer configd[67]: AppleTalk startup
Apr 13 22:15:57 Marc-Weinbergs-Computer TabletDriver[119]: #### GetFrontProcess failed to get front process (-600)
Apr 13 22:15:59 Marc-Weinbergs-Computer configd[67]: posting notification com.apple.system.config.network_change
Apr 13 22:16:00 Marc-Weinbergs-Computer configd[67]: posting notification com.apple.system.config.network_change
Apr 13 22:16:00 Marc-Weinbergs-Computer configd[67]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/enable-net work
Apr 13 22:16:00 Marc-Weinbergs-Computer configd[67]: posting notification com.apple.system.config.network_change
Apr 13 22:16:01 Marc-Weinbergs-Computer lookupd[123]: lookupd (version 369.5) starting - Sun Apr 13 22:16:01 2008
Apr 13 22:16:01 Marc-Weinbergs-Computer kernel[0]: HFS: Removed 2 orphaned unlinked files
Apr 13 22:16:01 Marc-Weinbergs-Computer diskarbitrationd[69]: disk3s3 hfs CDA8BCC5-0CE4-33E8-A910-4B0952DBC230 FullBU-09-07 /Volumes/FullBU-09-07
Apr 13 22:16:04 Marc-Weinbergs-Computer configd[67]: target=enable-network: disabled
Apr 13 22:16:05 Marc-Weinbergs-Computer configd[67]: AppleTalk startup complete
Apr 13 22:16:09 Marc-Weinbergs-Computer TabletDriver[237]: #### GetFrontProcess failed to get front process (-600)
Apr 13 22:16:09 Marc-Weinbergs-Computer launchd[241]: com.wacom.wacomtablet: exited with exit code: 253
Apr 13 22:16:09 Marc-Weinbergs-Computer launchd[241]: com.wacom.wacomtablet: 9 more failures without living at least 60 seconds will cause job removal
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:28 EDT 2008] : ATA device 'ST3320620AS', serial number '6QF0L6LR', reports it is functioning at a temperature of 95.0F (35C) degrees.
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:28 EDT 2008] : Spare blocks for ATA device 'ST3320620AS', serial number '6QF0L6LR', appear to still be available. (Total Available: 36) (Use Attempts: 0)
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : ATA device 'ST3320620AS', serial number '6QF0LGS4', reports it is functioning at a temperature of 100.4F (38C) degrees.
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : Spare blocks for ATA device 'ST3320620AS', serial number '6QF0LGS4', appear to still be available. (Total Available: 36) (Use Attempts: 0)
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : ATA device 'ST3320620AS', serial number '9RV000FC', reports it is functioning at a temperature of 95.0F (35C) degrees.
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : Spare blocks for ATA device 'ST3320620AS', serial number '9RV000FC', appear to still be available. (Total Available: 36) (Use Attempts: 0)
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : ATA device 'Maxtor 6B300S0', serial number 'B6211G0H', reports it is functioning at a temperature of 89.6F (32C) degrees.
Apr 13 22:16:29 Marc-Weinbergs-Computer /Applications/DiskWarrior.app/Contents/MacOS/DiskWarriorDaemon: [Sun Apr 13 22:16:29 EDT 2008] : Spare blocks for ATA device 'Maxtor 6B300S0', serial number 'B6211G0H', appear to still be available. (Total Available: 63) (Use Attempts: 0)
Apr 13 22:16:54 Marc-Weinbergs-Computer /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder: _TIFFVSetField: tiff data provider: Invalid tag "Copyright" (not supported by codec).\n
Apr 13 22:16:54 Marc-Weinbergs-Computer /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder: _TIFFVSetField: tiff data provider: Invalid tag "Copyright" (not supported by codec).\n
etc.

Hi-
The machine seems to be having trouble with loading certain drivers, but, as this isn't a crash log, and doesn't show the "hang-up" or freeze, it's hard to tell.
Noted possibilities are:
-Microsoft keyboard (possible USB power problem)
-firmtek driver (from archive) questionable due to the "archive" annotation
-Wacom tablet driver, causing system problems
Running in Safe mode without freezes would help to determine if one of these drivers is the problem.
Other possibilities are outdated drivers, or simply a need to reinstall the OS.
If unnecessary, removing the driver(s) would be a good idea.
External USB and Firewire devices are all suspect, should all be disconnected, revert to Apple keyboard, and test system performance. Adding one device at a time, and testing each will be necessary to clear each device.
I have experienced system trouble when a Wacom tablet was not connected, but the driver was left installed.
Disabling the driver from Startup items may be necessary to test without the Wacom tablet connected.

Mdworker saturating the system.log file

Hi,
i have a problem on my late 2010 MBA, running 10.6.8. Frequently, the fan goes frantic, and it appears it is linked to mdworker running over and over again. It seems to be doing that when the vpn from the company is running (Juniper through Secure App Manager).
I checked the system.log file and it is 2.63Go for the past 5 days! Mostly filled with
Jan 3 08:45:39 Puss mdworker[59604]: socket(PF_ROUTE) failed: Operation not permitted
Jan 3 08:45:39 Puss sandboxd[59747]: mdworker(59604) deny system-socket
Jan 3 08:45:39 Puss sandboxd[59747]: mdworker(59604) deny network-outbound /private/var/run/mDNSResponder
(repeated 500 times and over, and eventually:
Jan 3 08:45:39: --- last message repeated 1 time ---
Jan 3 08:45:39 Puss mdworker[59604]: socket(PF_ROUTE) failed: Operation not permitted
Jan 3 08:45:39 Puss sandboxd[59747]: mdworker(59604) deny system-socket
Jan 3 08:45:39 Puss com.apple.launchd[1] (0x100101ea0.mach_init.mdworker[59604]): Exited with exit code: 1
Can the vpn really have an influence on Spotlight? What is spotlight trying to index and why is it denied?
Eventually, i may be dreaming, but it seems that something is chewing up my SSD space. Without adding much files, it feels like free space is going down.
Thanks for any help.

I solved the problem by adding the hidden '/private' directory on the harddisk to the places that spotlight is forbidden to index (in the systems preference pane -> Spotlight ->Privacy)
You have drag the '/private' folder into the locations box.
You may have to install something like 'secrets' to show hidden folders in the finder.
(see here: https://code.google.com/p/blacktree-secrets/wiki/Help )
ignore everything above - same error messages came back

How to clean large system log files?

I believe that OS X saves a lot of system data in log files that become very large.
I would like to clear old history logs.
How may I view and clean system log files?

Thank you Niel.
I have obtained the list at /private/var/log.
There are a lot of files in there.
Since I am not familiar with functions of these files should I be concerned that by simply deleting all of the files in folder /private/var/log will not cause any problems? Would this action present some unintended consequences?

Silverlight fills up system.log file

In order to watch the NBC Olympics, I had to install Silverlight. I had hesitation and now know why. While the player seems to play just fine and all, it is kicking massive error messages to the system.log file. It fills many megabytes and therefore the daily syslog rotation runs bzip2 for a long time each night.
Here is a sampling from my system.log file, using Safari 4.0.4 on OS-X 10.6.2.
Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * set a breakpoint in mallocerrorbreak to debug
Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x1980bf94: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x5ef8e14: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x1980bf94: pointer being freed was not allocated
Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * set a breakpoint in mallocerrorbreak to debug
Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x5ef8e14: pointer being freed was not allocated
Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * set a breakpoint in mallocerrorbreak to debug
Feb 22 01:33:28 KR-iMac com.apple.WebKit.PluginAgent[593]: * process 593 exceeded 500 log message per second limit - remaining messages this second discarded *
Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x1980bf94: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
Feb 22 01:33:28 KR-iMac WebKitPluginHost[1002]: WebKitPluginHost(1002,0xb071b000) malloc: * error for object 0x5ef8e14: pointer being freed was not allocated\n* set a breakpoint in mallocerrorbreak to debug
Notice it exceeds over 500 messages a second. Anyway to mute these messages???

The problem with just deleting the file, is two fold.
First, the system needs this file to continue to post system messages. If you delete it, or just trash it, the system will just continue to add to the trashed file using the open file pointers, or simply create a new one.
Second, Silverlight will continue to generate messages, and ultimately still go into the system.log. Deleting the file is not such a good idea while the operating system is still using it.
I recommend doing the following to clear the file without deleting it:
You'll need to Enable the root user on your computer if you haven't yet. Search other threads for how to do this on your version of OS-X.
In Terminal, log in as root.
username$ sudo -i
Change to the /var/log folder.
root# cd /var/log
Use the truncate function to simply zero out the file.
root# >system.log
You'll need to do this everyday, after running Silverlight, hopefully BEFORE the daily log rotating cron scripts try to rotate the logs and perform a bzip compression of the file (which will tax your system for a few hours). You may want to find any log files ending in .bz2 and remove those. You can delete those, as they are just archives of old system log files and are not used any more.

System.log file super bloat!

Tonight my hard disk suddenly started filling rapidly on it's own and I traced the problem down to an amazingly fast growing system.log file. It appeared to be corrupt because the Console app didn't see it when I tried to read it there to see what was filling it. It got up to 6GB!
I pulled the file out of there and things seem okay (I still have it in visible form on another drive). Is is at problem that now my OS X drive has no system.log file? Will it create one on it's own eventually? Is there some way for me to replace it?
Any ideas why it would have done that?
Thanks for any education!
-Dave

Hi Tenfresh, you don't list your system specs so it's hard to tell but this may have been your issue:
http://docs.info.apple.com/article.html?artnum=300893
Yes, the system.log will recreate, if it hasn't done so already.
-mj
[email protected]

System Logs & File Tags - logic board replacement

Hi,
I do have some queries for the logic board replacement on macbook pro running Yosemite:
If logic board is replaced -
1) Does the system log files available in console [Finder -> Applications -> Utilities -> Console] gets deleted or they will still be showing up from the date prior to the replacement of the logic board?
2) If I've created file tags before LB replacement, will they still show up after the replacement?
Any insight into the above will be of immense help.
Thanks.

It would need to be done by Apple Service. They should have the equipment to do this. Your serial number can be found under the battery and on you box your MacBook came in.

When upgrading from 10.7 to 10.8.2, are the system.log files backed up anywhere?

One of my clients needs to confirm whether a USB device was plugged into their computer between two dates in September 2012 because they're worried some sensitive data may have been stolen. However, their computers were upgraded from 10.7 to 10.8.2 on the 29th of November 2012, and since the kernel.log and system.log files have now been combined in this update, it has obviously created a new file in the new format. Sadly, this has only come to light now, and there appear to be no backups of the whole drive from before this date.
Does anyone know if the 10.7 logfiles would have been preserved anywhere during the upgrade, or are they lost for good?

No, the merging operation deletes the old files during upgrading the OS X. Have you tried searching even hidden files starting at the root level so see if anything has been hidden away somewhere? I haven't seen the upgrade do that but if this is really important it may be worth the effort.

System.log files filling up in 10.6?

Something is filling up my system log files, to the point that console.app will only show the last half hour of each file. It looks like something is trying to escape its sandbox, but I'm not exactly sure what... I'm getting MANY repeated messages that look like:
Feb 3 00:29:57 Brians-mini sandboxd[16]: syslogd(15) deny file-read-data /private/var/log/asl/StoreData
Feb 3 00:29:57 Brians-mini sandboxd[16]: syslogd(15) deny mach-task-name
Feb 3 00:29:59: --- last message repeated 1 time ---
Feb 3 00:29:57 Brians-mini sandboxd[16]: * process 16 exceeded 500 log message per second limit - remaining messages this second discarded *
Feb 3 00:29:57 Brians-mini sandboxd[16]: syslogd(15) deny mach-task-name
has anyone seen this? (And does this belong in a different forum?)

It sounds like someone may be trying to connect to your computer. When things are repeatedly denied, especially task-opening commands, it is usually suspected that something is trying to get in. This may be malicious, or may not be, depending on how you connect to the Internet. If you share a connection at home or even between residencies (check with your ISP if you're not sure), it can be normal. See if it still happens after you physically disconnect the network. Also, make sure to disconnect peripherals just to make sure they aren't causing any of the issues.

Huge system.log file filled with over a million messages about NSATSTypeset

Hi,
I just happened to notice the system.log file on my MacBook Pro laptop was absolutely huge - over 1.2 GBytes in just one day. Almost all of it is messages like this:
Mar 31 12:26:23 macbook quicklookd[228]: <NSATSTypesetter: 0x146b40>: Exception * table 0x1473caa0 has block 0x147b3040 rather than 0x147b4850 at index 7573 raised during typesetting layout manager <NSLayoutManager: 0x124140>\n 1 containers, text backing has 16461 characters\n selected character range {16461, 0} affinity: downstream granularity: character\n marked character range {16461, 0}\n Currentl
y holding 16461 glyphs.\n Glyph tree contents: 16461 characters, 16461 glyphs, 4 nodes, 128 node bytes, 16384 storage bytes, 16512 total bytes, 1.00 bytes per character, 1.00 bytes per glyph\n Layout tree contents: 16461 characters, 16461 glyphs, 7573 laid glyphs, 207 laid line fragments, 3 nodes, 96 node bytes, 13656 storage bytes, 13752 total bytes, 0.84 bytes per character, 0.84 bytes per glyph, 36.58 laid glyphs per laid line fragment, 66.43 bytes per laid line fragment\n, glyph range {7573 0}. Ignoring...
and there are over 1.3 million of these messages!!!! There is a tiny bit of variation in some of the numbers (but not all). That is just a little bit more than the total number of files I have on the hard drive in the laptop, so it would appear that the quicklookd is doing something to each and every file on the computer. Any idea why all of a sudden these messages appear and why so many. I only have about 7 versions of the system.log files and none of them are even close to this big, but the one one thing I did do today that I have not in a few weeks is reboot my laptop because of another problem with the laptop screen not waking this morning from being put to sleep last night (was just black but computer was running and could login to it from another computer in the LAN it is attached).
Any ideas why this is happening, or is this something that always happens on a reboot/boot rather than waking from sleep. Why would the quicklookd be printing out so many of these messages that are almost exactly alike???
I have only had this MacBook for a few weeks, so don't have a good feel for what is normal and what isn't yet.
THanks...
-Bob

Bob,
Thanks for your further thoughts and the additional information. My guess is that Quick Look does its file processing independently of whether or not or how recently the computer has been rebooted. The NSATSTypesetter messages filling up the log file are almost certainly error messages and should not occur with normal operation of Quick Look. I suspect that your reboot doesn't directly have anything to do with this problem. (It might have indirectly contributed in the sense that either whatever caused the need for the reboot or the reboot process itself corrupted a file, which in turn caused Quick Look to fail and generate all those error messages in the log file.)
In the meantime I may have a solution for this problem. This morning I rebooted in single user mode and ran AppleJack in manual mode so that I could tell it to clean up all user cache files. (I'd previously downloaded AppleJack application from http://applejack.sourceforge.net/ . To boot in single user mode hold command and s keys at startup chime. ... Run the five AppleJack maintenance tasks in order. The third task will give you the option to enter numbers of users whose cache files will be cleaned. Do this cache cleaning for all users.) In the six hours since I ran AppleJack I've seen exactly two NSATSTypesetter error messages in /var/log/system.log . This compares with hundreds of thousands in the same period yesterday. I just set an iCal alarm to remind me to report back to this discussion thread in two weeks on this issue.
Best,
Chris.
PS: Above you mention 7 log files. Are the older ones of the form system.log.0.bz2 ? If so they have been compressed. Just because they are small doesn't necessarily mean there are not a lot of nearly identical error messages. Uncompress to check. I haven't tried this because large files are very inconvenient to work with on my old iBook.

System.log file are large, and cause a kernel panic when deleting

Hello everyone,
I am trying to solve a dillema. I discovered that over 60GB of my 120GB SSD drive are taken up by system.log files. All 3 are around 20GB. I left my laptop running so none of them are the current one. They are system.log.0, system.log.3 and system.log.4. I have tried several ways to delete them:
Using Disksweeper
At a terminal prompt using sudo rm
At a terminal prompt using sudo su - (to get root access) and then rm -f ....
Rebooting the system in single user mode, mounting the drive and then attempting to delete them
Each time I do, the system reboots with a kernel panic. I have not looked at the panic log yet, but can post that if you need to.
I did look at the end of the current log file to discover there were some issues with programs, and I have fixed it so that these size log files "shouldn't" be generated anymore.
Looking for advice as to how to delete these files! This is driving me nuts. It shouldn't be this hard.
Thanks for any help or insight you can give.

OK, I actually was able to solve this myself. My problem was that ther kernel panic was caused by the journaling. So here is what I had to do:
I temporarily disabled journaling, see here: http://forums.macrumors.com/showthread.php?t=373067
Then I was able to delete the files by starting a terminal session and using sudo rm to delete the files.
Re-enabled journaling (I don't know if it is needed, but it was on before).
Hope this can help someone else in the future.

With Mac OS X can the system.log files be safely deleted?

I just did a search of my HD using OmniDiskSweeper, and there's a file called system.log that's 8GB The path is /private/var/log/system.log Can this file be deleted without any bad effects? Wouldn't the system just create a new one when needed? I opened the file in Console, looked at some of it, and as far as I can tell I would think it's okay to delete, but I'd like to be sure before I do it. Thanks!

I also just found a new file was created-- /private/var/tmp/tmp.1.UhmvZp after I looked in the console and had to force quit. That one is 3.3GB. Any of these files can be deleted? I know not to delete the sleepimage file, which just created another 1GB swapfile and is up to 4GB.
In September I brought my Macbook to an Apple genius because I was loosing so much HD space without downloading or installing anything. He told me to reinstall the OS and it did help recover some space. Now I know where that HD space is going!

File system log files for SOA Gateway

Hi All,
I need to get log files for my integration repository/SOA Gateway since I'm not able to generate any WSDL or to deploy a web service. In the SOA trouble shoot document, it says:
Log on to Oracle E-Business Suite with the username that has the System Administrator responsibility access privilege.
Select the System Administrator responsibility from the Navigator and choose Oracle Applications Manager > Logs.
Click Log Setup to open the Java System Property Settings page.
Click the Site link and enable log for
Midtier Log File Name: Enter the file name that you would like on the middletier, for example, '/tmp/SOA /tmp/SOALog.log'.
Module=Enter an appropriate module name, for example, 'fnd.soa%'.
Ask your System Administrator to bounce oafm container.
Perform any SOA specific action, such as generate a WSDL file for an PL/SQL API.
Look for logs in the file specified in the Midtier Log File Name field.
My problem is, that my EBS installation is running on windows, so '/tmp/SOA /tmp/SOALog.log' will not work, right? I tried something like /temp/... or c:/temp/... or c:\temp\... but I did not get a logfile called SOALog.log.
What do I have to provide as path here?
Many thanks,
Konrad

Hi!
Did you encounter any error?Yes!
>
try givng C:\temp remember temp should have read and write permissions for the oracle applications o/s user(applmgr)Using c:\temp\test.log results in the following error while saving the log setting:
An error has occurred!
For input string: "10001:\temp\test.log"
I can use whatever string I want, but as long as a ":" is included, I get that error.
As for the user permissions. I installed the EBS using the standard Administrator account and this account is a member of Administrators and ora_dba.
Best,
Konrad

System Log Files - which can be removed

i have two system log folders that are about 10Gb in size each. I would like to recover some of this space, but am unsure of which files I can safely delete.
DiskName>Users>UserID>Library>Application Support>MobileSyn>Backup
This folder has nine folders of varying size from a few MB to 3.1GB. Four are over 700MB
Which can I safely delete, and what am I "losing" by deleting the older ones?
DiskName>private>var>log
contains a number of files consistently named "systemlog.#" with all but one of them named "systemlog.#.bz2"
The .bz2 files were created by Archive Utility.
the file without the .bz2 extension does not show a creator application in the SysInfo box.
Can any of these files be deleted?
The current one is over 3Gb in size, and one of the .bz2 files is over 2Gb
Is there a Utility that will automatically manage these backup/log files to remove them after a defined period of time?
Thanks in advance for any input
PeterP
Sydney, Australia

Well, I solved the MobileSync files question
And yes ... I apologise ... I mispelled the file directory name. I should have been:
DiskName>Users>UserID>Library>Application Support>MobileSync>Backup
These files are created by iTunes each time you backup your iPhone.
Under iTunes>Preferences>Devices, there is a list of backups of the iPhone being maintained by iTunes (Device Backups).
I had had a number of changes of serial number of my iPhone as I moved my earlier generation iPhone around my family, and as I had iPhones replaced after repair/warranty. Each time you do that, iTunes opens a new folder in the Backups directory. It also seems to close the current folder and open a new folder from time to time, as the past three folders are all with the same iPhone serial number.
Whatever, by deleting the old unwanted backups via iTunes Preferences>Devices>Device Backups, iTunes also politely deleted the folders in the ...
DiskName>Users>UserID>Library>Application Support>MobileSync>Backup
... folder, thus solving this problem.
Thank you to Thomas A Reed, and to Francine Schwieder for your kind assistance in pointing me in the right direction on this matter.
Re the systemlog file that is obviously "old" but doesn't have a .bz2 extension, as this file is only 5 days old, I have decided not to mess with it, and allow MacOSX to clean this up over time. I suspect either the weekly or monthly Unix Script run by the Marcaroni utility, (which I installed years ago), will take care of this.
I took your advice Thomas and opened that log to see what was filling it up.
I got lots of messages like this:
21/02/11 14:18:54 com.vvi.peervisualserver[57] SCS Client Error: Error connecting to SCS type server process for channels 1 through 1 inclusive.
21/02/11 14:19:04 com.vvi.peervisualserver[57] 2011-02-21 14:19:04.195 PeerVisualServer[27813:903] The application with bundle ID com.vvi.PeerVisualServer is running setugid(), which is not allowed.
21/02/11 14:19:04 com.vvi.peervisualserver[57] SCS Client Error: Error connecting to SCS type server process for channels 0 through 0 inclusive.erVisualServer is running setugid(), which is not allowed.
This runs continuously through the log.
and like this:
21/02/11 14:19:00 com.apple.launchd.peruser.502[172] (at.obdev.LittleSnitchUIAgent) Throttling respawn: Will start in 10 seconds
21/02/11 14:19:02 com.apple.launchd[1] (at.obdev.littlesnitchd[27811]) Exited with exit code: 1
I am running Little Snitch so this is perhaps not surprising.
Thanks for your inputs on this. I will post in three weeks time if Marcaroni has deleted the systemlog file.
Sincerely
PeterP
Sydney, Australia

How do I view IOS system log files on my iPhone?

I'm getting occasional buzzes on my iPhone when it is in silent mode, but it's not obvious where the buzzes are coming from. How can I view the IOS log files on the phone to figure out which application is generating the alerts?

Hey Steve,
You'll want to connect your phone to your computer and sync it in iTunes. You can read more about it here:
iOS: Syncing your data with iTunes
http://support.apple.com/kb/HT1386
Welcome to Apple Support Communities!
Have a good one,
Delgadoh

System.log file

Similar Messages

Maybe you are looking for