In previous version of OSX, I was able to view the results of past Time Machine backup jobs thus:

sudo syslog -F '$Time $Message' -k Sender com.apple.backupd

Now syslog is no longer part of the operating system. It has been replaced by "log."

I have failed to find info about time machine jobs using "log." I have also failed using (the new version of) console.

Any suggestions?

7 Answers 7


macOS Sierra uses Unified Logging (memory and a data store; no text files any longer).

However, with the log(1) utility, you can view, filter, manipulate etc. logs. See man log, and here's a couple of TimeMachine-specific examples:

Stream the log, live (like tail):

log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

Don't stream, just show the log and exit:

log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

  • Hello Chipster, thanks for the reply. Unfortunately your suggestion did not work. I applied the second of your commands (Don't stream) and all I got was this: 2016-09-22 10:25:17.242554-0700 localhost eventsd[4378]: (TimeMachine) TimeMachineMonitor Running This, after doing two time machine backups.
    – Arnstein
    Sep 23, 2016 at 3:16
  • Hello again Chipster, Your second command (Don't stream) is working for me now. However this command only returns info about the last Time Machine backup that I performed. I speculate that after every reboot, all logging info is lost. Do you think this is true? Is there a way to query for older info?
    – Arnstein
    Sep 23, 2016 at 17:05
  • Arnstein, I'm new to this too, but it is my understanding that log messages of level "Info" only are kept in memory by default and will therefore not survive a reboot. If you want TimeMachine Info messages to be saved to disk, try doing: # log config --subsystem com.apple.TimeMachine --mode persist:info (as root).
    – Lennart L
    Sep 23, 2016 at 22:49

I had a similar problem. I wrote this shell script to show me the last 12 hours of Time Machine activity from the log, and then continue to follow the log live.

I call it tm-log


filter='processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'

# show the last 12 hours
start="$(date -j -v-12H +'%Y-%m-%d %H:%M:%S')"

echo ""
echo "[History (from $start)]"
echo ""

log show --style syslog --info --start "$start" --predicate "$filter"

echo ""
echo "[Following]"
echo ""

log stream --style syslog --info --predicate "$filter"
  • 8
    log takes a --last parameter, which can be simpler than computing --start (e.g. --last 12h to show the last 12 hours)
    – Miles
    Aug 6, 2017 at 0:02

For those looking for a live view of Time Machine messages in the GUI Console app, enable "Include Info Messages" in the Action menu.

The useful Time Machine status messages will then show up and can be filtered with a search like Category:TMLogInfo.

It looks like log(1) is needed to view the history since Console doesn't show anything from before it was opened.

  • Thanks for this! I also had to add Category:TMLogError to be able to see the error messages ;)
    – gsaslis
    Oct 9, 2019 at 11:48

Here's improved version of @JimRandell tm-log script:

#!/usr/bin/env bash

ARGS=( --style default --info --predicate 'processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"' )

log() {
    /usr/bin/log "$@" "${ARGS[@]}" | tr -s ' ' | sed 's/com.apple.TimeMachine://g' | cut -d' ' -f 1,2,10-

log show --last $LAST
log stream

By default it shows Time Machine log for the last three hours and then waits for log messages. You can change default time period for last messages:

$ tm-log 12h

Currently, my solution is to use log stream --style syslog --predicate 'subsystem == "com.apple.TimeMachine"' --info. But I am not quite happy with it, so I am still searching for a better way.


Copy & Paste the Following exactly as shown below

log show --predicate 'subsystem == "com.apple.TimeMachine"' --info | grep 'upd: (' | cut -c 1-19,140-999


In "terminal" type (or copy from here and paste):

log stream --style syslog  --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

This works, but as this is streaming, it displays the activity as it happens. If there's no time-machine activity - it will not display much (or anything). Initially is may dump stuff that's a few days old that may be cached somewhere, but then it displays the log in pretty much real-time.

I have used this stream of the log to identify a specific corrupt file on my disc that was preventing completion of backups. Removed the file (actually a whole folder) and woilla - backup completed on first run. No more errors.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .