39

In previous version of OSX, I was able to view the results of past Time Machine backup jobs thus:

sudo syslog -F '$Time $Message' -k Sender com.apple.backupd

Now syslog is no longer part of the operating system. It has been replaced by "log."

I have failed to find info about time machine jobs using "log." I have also failed using (the new version of) console.

Any suggestions?

53

macOS Sierra uses Unified Logging (memory and a data store; no text files any longer).

However, with the log(1) utility, you can view, filter, manipulate etc. logs. See man log, and here's a couple of TimeMachine-specific examples:

Stream the log, live (like tail):

log stream --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

Don't stream, but show the log end exit:

log show --style syslog --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

  • Hello Chipster, thanks for the reply. Unfortunately your suggestion did not work. I applied the second of your commands (Don't stream) and all I got was this: 2016-09-22 10:25:17.242554-0700 localhost eventsd[4378]: (TimeMachine) TimeMachineMonitor Running This, after doing two time machine backups. – Arnstein Sep 23 '16 at 3:16
  • Hello again Chipster, Your second command (Don't stream) is working for me now. However this command only returns info about the last Time Machine backup that I performed. I speculate that after every reboot, all logging info is lost. Do you think this is true? Is there a way to query for older info? – Arnstein Sep 23 '16 at 17:05
  • Arnstein, I'm new to this too, but it is my understanding that log messages of level "Info" only are kept in memory by default and will therefore not survive a reboot. If you want TimeMachine Info messages to be saved to disk, try doing: # log config --subsystem com.apple.TimeMachine --mode persist:info (as root). – Lennart L Sep 23 '16 at 22:49
29

I had a similar problem. I wrote this shell script to show me the last 12 hours of Time Machine activity from the log, and then continue to follow the log live.

I call it tm-log

#!/bin/sh

filter='processImagePath contains "backupd" and subsystem beginswith "com.apple.TimeMachine"'

# show the last 12 hours
start="$(date -j -v-12H +'%Y-%m-%d %H:%M:%S')"

echo ""
echo "[History (from $start)]"
echo ""

log show --style syslog --info --start "$start" --predicate "$filter"

echo ""
echo "[Following]"
echo ""

log stream --style syslog --info --predicate "$filter"
  • 5
    log takes a --last parameter, which can be simpler than computing --start (e.g. --last 12h to show the last 12 hours) – Miles Aug 6 '17 at 0:02
10

For those looking for a live view of Time Machine messages in the GUI Console app, enable "Include Info Messages" in the Action menu.

The useful Time Machine status messages will then show up and can be filtered with a search like Category:TMLogInfo.

It looks like log(1) is needed to view the history since Console doesn't show anything from before it was opened.

  • Thanks for this! I also had to add Category:TMLogError to be able to see the error messages ;) – gsaslis Oct 9 at 11:48
2

Currently, my solution is to use log stream --style syslog --predicate 'subsystem == "com.apple.TimeMachine"' --info. But I am not quite happy with it, so I am still searching for a better way.

0

Copy & Paste the Following exactly as shown below

log show --predicate 'subsystem == "com.apple.TimeMachine"' --info | grep 'upd: (' | cut -c 1-19,140-999

0

In "terminal" type (or copy from here and paste):

log stream --style syslog  --predicate 'senderImagePath contains[cd] "TimeMachine"' --info

This works, but as this is streaming, it displays the activity as it happens. If there's no time-machine activity - it will not display much (or anything). Initially is may dump stuff that's a few days old that may be cached somewhere, but then it displays the log in pretty much real-time.

I have used this stream of the log to identify a specific corrupt file on my disc that was preventing completion of backups. Removed the file (actually a whole folder) and woilla - backup completed on first run. No more errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.